EUVD-2016-4980

Malware in sbrugna...

CVE-2016-3971

Cross-site scripting XSS vulnerability in lucenesearch.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout...

CVE-2016-3971

CVE-2016-3971 describes an XSS vulnerability in dotCMS where a crafted value in the query parameter to c/portal/layout is reflected by lucene_search.jsp. Affected product: dotCMS, versions before 3.5.1. Root cause: cross-site scripting due to improper handling of user-supplied input. Impact: pote...

DotCMS 3.5 Beta Cross Site Scripting

Advisory: DotCMS xss vulnerability Author: Piaox From Pingan Product Safety Group Email: [email protected] Affected Version: dotCMS 3.5 Betathe latest version Vulnerability Description lucenesearch.jsp 26 String query = request.getParameter"query"; 27 if!UtilMethods.isSetquery 28 query ...