49 matches found
CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java"...
CVE-2020-27848
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user mus...
CVE-2018-16980
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...
DotCMS 安全漏洞
DotCMS is an open source content management system written in Java by DotCMS, Inc. for managing content and content-driven sites and applications. A security vulnerability exists in DotCMS. An attacker exploiting the vulnerability could mimic other users by session ID...
DotCMS Cross-Site Scripting Vulnerability
DotCMS is an open source content management system written in Java by DotCMS Inc. for managing content and content-driven sites and applications. A cross-site scripting vulnerability exists in DotCMS. An attacker could exploit this vulnerability to perform cross-site scripting attacks...
PT-2023-22684 · Dotcms · Dotcms
Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 23.06 dotCMS versions prior to LTS 22.03.7 dotCMS versions prior to LTS 23.01.4 Description: A flaw in the NormalizationFilter of dotCMS does not strip double slashes // from URLs, potentially enabling bypasses for XS...
dotCMS 安全特征问题漏洞
dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, forums, etc., and is easy to extend and build. A security signature issue vulnerability exists in dotCMS core versions 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1,...
CVE-2022-37033
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no...
PT-2022-22958 · Dotcms · Dotcms
Name of the Vulnerable Software and Affected Versions: dotCMS versions prior to 22.06 dotCMS version 5.3.8.12 dotCMS version 21.06.9 dotCMS version 22.03.2 Description: The issue allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a U...
GHSA-42VG-Q6MW-CFH5 dotCMS allows remote authenticated users to execute arbitrary Java code
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...
dotCMS Cross-Site Scripting Vulnerability (CNVD-2021-50940)
dotcms is a powerful Content Management System CMS developed in Java. A stored cross-site scripting vulnerability exists in dotCMS version 21.05.1 in dotAdmin//c/cImages, which can be exploited by an attacker to execute arbitrary Web script or HTML via the 'Title' and 'Filename' parameters...
dotCMS Cross-Site Scripting Vulnerability (CNVD-2021-50941)
dotcms is a powerful Content Management System CMS developed in Java. A reflective cross-site scripting vulnerability exists in dotAdmin//c/containers in dotCMS version 21.05.1, which can be exploited by an attacker to execute arbitrary commands or HTML...
Cross site scripting
A reflected cross site scripting XSS vulnerability in dotAdmin//c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...
File Upload Vulnerability in dotCMS
dotCMS is a content management system CMS. A file upload vulnerability exists in dotCMS, which can be exploited by an attacker to upload arbitrary files...
CVE-2019-12872
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via viewunpushedbundles.jsp...
dotCMS Open Redirect Vulnerability
dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A security vulnerability exists in dotCMS versions prior to 5.0.2. An attacker can exploit this vulnerability to...
Dotcms cross-site scripting vulnerability (CNVD-2018-26792)
dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in dotCMS 5.0.3 and earlier versions. A remote attacker can leverage t...
CVE-2018-16980
dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...
