PT-2022-5116 · Unknown · Dotcms Core

Name of the Vulnerable Software and Affected Versions: dotCMS Core versions through 22.06 Description: The issue is related to a Reflected Cross-site scripting XSS problem in the admin portal of dotCMS Core. This occurs when the configuration has XSS PROTECTION ENABLED set to false. The...

PT-2022-2512 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS versions 3.0 through 22.02 Description: An issue was discovered in the ContentResource API, allowing attackers to craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal,...

Improper access control

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl velocity files...