CVE-2016-10007

SQL injection vulnerability in dotCMS affects Marketing > Forms for versions before 3.7.2 and 4.x before 4.1.1. The issue allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter. Affected component: dotCMS form handling in Market...

CVE-2016-10008

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTSTRUCTUREdirection parameter...

CVE-2016-10008

CVE-2016-10008 affects dotCMS (Content Types screen) with an SQL injection in the _EXT_STRUCTURE_direction parameter. Vulnerable in dotCMS versions before 3.7.2 and 4.x before 4.1.1, allowing remote authenticated administrators to execute arbitrary SQL. Fixed in 3.7.2 and 4.1.1; remediation is up...

CVE-2016-10007

SQL injection vulnerability in the "Marketing Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTFORMHANDLERorderBy parameter...

CVE-2016-10008: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTSTRUCTUREdirection parameter...

CVE-2016-10007: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Marketing Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the EXTFORMHANDLERorderBy parameter...

dotCMS SQL Injection

Title: Multiple SQL injection vulnerabilities in dotCMS 2x CVE Credit: Elar Lang / https://security.elarlang.eu Vendor/Product: dotCMS http://dotcms.com/ Vulnerability: SQL injection Vulnerable version: before 4.1.1. Theoretically would be fixed in 3.7.2 not released yet CVE: CVE-2016-10007,...

dotCMS End of Life (EOL) Detection

The dotCMS version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

dotCMS 4.1.1 Remote Shell Upload Vulnerability

dotCMS is prone to a remote shell upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotcms:dotcms"; if...

dotCMS 4.1.1 XSS Vulnerability

dotCMS is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotcms:dotcms...

dotCMS Stored Cross-Site Scripting Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in the vanity-urls Title field in dotCMS version 4.1.1, which originat...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

Cross site scripting

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The CVE-2017-15219 entry concerns the dotCMS 4.1.1 application with a Stored Cross-Site Scripting (XSS) vulnerability. Affected fields include vanity-urls Title, containers Description, and templates Description, with exploitation arising from insufficient input filtering of user-submitted conten...

CVE-2017-15219: Improper Neutralization of Input During Web Page Generation

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

DOTCMS4. 1. 1 arbitrary file upload vulnerability

Recetly, I found an Arbitrary File Upload Vulnerability in 'DotCMS' program, DotCMS is widely used in many companies. Vulnerable cgi: /dotcms4.1.1999999.jar!/com/dotmarketing/servlets/AjaxFileUploadServlet.class: private void doFileUploadHttpSession session, HttpServletRequest request,...

CVE-2017-11466

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajaxfileupload. This results...

CVE-2017-11466

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajaxfileupload. This results...