CVE-2012-1039

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

CVE-2012-1039

CVE-2012-1039 involves multiple XSS vulnerabilities in Dotclear up to version 2.4.2. The issues allow remote attackers to inject arbitrary script/HTML via several parameters: login_data (admin/auth.php), nb (admin/blogs.php), type/sortby/order/status (admin/comments.php), and page (admin/plugin.p...

Unrestricted file upload

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-5083

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-5083

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-5083

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2011-5083

Affected software: Dotclear 2.3.1 and 2.4.2. Vulnerable component: inc/swf/swfupload.swf. Issue: Unrestricted file upload allowing remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension and accessing it via direct request in an unspecified directory. Root cause: u...

CVE-2011-5083: Undefined Security Weakness

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

CVE-2012-1039: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

PT-2012-3036

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the login data parameter to "admin/auth.php", the nb parameter to...

PT-2012-2061

Name of the Vulnerable Software and Affected Versions Dotclear versions 2.3.1 through 2.4.2 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...

Multiple XSS in Dotclear 2.4.1.2

No description provided by source. Advisory ID: HTB23074 Product: Dotclear Vendor: Dotclear Vulnerable Versions: 2.4.1.2 and probably prior Tested Version: 2.4.1.2 Vendor Notification: 8 February 2012 Vendor Patch: 9 February 2012 Public Disclosure: 29 February 2012 Vulnerability Type: Cross Site...

Dotclear 2.4.1.2 - adminplugin.php?page Cross-Site Scripting

Dotclear 2.4.1.2 - adminplugin.php?page Cross-Site Scripting source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrar...

Dotclear 2.4.1.2 - admincomments.php Multiple Cross-Site Scripting Vulnerabilities

Dotclear 2.4.1.2 - admincomments.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issu...

Dotclear 2.4.1.2 - adminblogs.php?nb Cross-Site Scripting

Dotclear 2.4.1.2 - adminblogs.php?nb Cross-Site Scripting source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

Dotclear 2.4.1.2 - adminauth.php?login_data Cross-Site Scripting

Dotclear 2.4.1.2 - adminauth.php?logindata Cross-Site Scripting source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Dotclear 2.4.1.2 Cross Site Scripting

Advisory ID: HTB23074 Product: Dotclear Vendor: Dotclear Vulnerable Versions: 2.4.1.2 and probably prior Tested Version: 2.4.1.2 Vendor Notification: 8 February 2012 Vendor Patch: 9 February 2012 Public Disclosure: 29 February 2012 Vulnerability Type: Cross Site Scripting XSS CVE References:...

Dotclear 2.4.1.2 - '/admin/auth.php?login_data' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Dotclear 2.4.1.2 - '/admin/blogs.php?nb' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Dotclear 2.4.1.2 - '/admin/comments.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/52221/info Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...