PT-2018-14999

Name of the Vulnerable Software and Affected Versions Dotcms versions prior to 5.0.4 Description An issue was discovered that allows attackers to perform XSS attacks. The attack can be performed via the inode, identifier, or fieldName parameter in the "html/js/dotcms/dijit/image/image tool.jsp"...

Dotcms cross-site scripting vulnerability (CNVD-2018-26792)

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in dotCMS 5.0.3 and earlier versions. A remote attacker can leverage t...

Design/Logic Flaw

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...

PT-2018-13886

Name of the Vulnerable Software and Affected Versions OTCMS version 3.61 Description A security issue was found in OTCMS, where a cross-site scripting XSS attack can be executed. This issue is located in the admin/share switch.php file and is triggered by the fieldName, fieldName2, and tabName...

CVE-2018-17086: Improper Neutralization of Input During Web Page Generation

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...

dotCMS cross-site scripting vulnerability (CNVD-2019-07129)

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . The 'fieldName' and 'inode' parameters in the /html/portlet/ext/contentlet/imagetools/index.jsp page in dotCMS...

CVE-2018-16980

dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...

CVE-2018-16980

dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...

CVE-2018-16980

dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...

CVE-2018-16980

CVE-2018-16980 affects dotCMS v5.0.1 and is a cross-site scripting vulnerability in the /html/portlet/ext/contentlet/image_tools/index.jsp page, specifically in the fieldName and inode parameters. The connected documents corroborate XSS details (CNVD-2019-07129, NVD entry). The exact exploitabili...

CVE-2018-16980: Improper Neutralization of Input During Web Page Generation

dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/imagetools/index.jsp fieldName and inode parameters...

PT-2018-13813

Name of the Vulnerable Software and Affected Versions dotCMS version 5.0.1 Description The issue concerns a problem with the dotCMS software. It is reported that there is an XSS issue in the /html/portlet/ext/contentlet/image tools/index.jsp "fieldName" and "inode" parameters. Recommendations For...

PT-2017-12033

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1 Description The issue allows remote authenticated administrators to upload arbitrary files, including .jsp files, to any location on the server. This is achieved through directory traversal sequences in the fieldName...

XSS vulnerability in pagepicker.action and spacepagepicker.action

The following URL's are vulnerable: - /users/pagepicker.action - /users/spacepagepicker.action on formname, fieldname and currentspace panel:bgColor=99ff99 h4. Patch instructions for 2.6.x and 2.7.x 1. Shut down Confluence 2. Copy attached pagepicker.vm to confluence/users/ 3. Start up Confluence...