Show filters
57 Total Results
Displaying 51-57 of 57
Sort by:
Attacker Value
Unknown
CVE-2016-3688
Disclosure Date: April 19, 2016 (last updated November 25, 2024)
SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr.
0
Attacker Value
Unknown
CVE-2016-3972
Disclosure Date: April 18, 2016 (last updated November 25, 2024)
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.
0
Attacker Value
Unknown
CVE-2016-3971
Disclosure Date: April 18, 2016 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout.
0
Attacker Value
Unknown
CVE-2013-3484
Disclosure Date: April 02, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html, (2) my_account_login parameter to c/portal_public/login, or (3) email parameter to forgotPassword.
0
Attacker Value
Unknown
CVE-2012-1826
Disclosure Date: June 08, 2012 (last updated October 04, 2023)
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
0
Attacker Value
Unknown
CVE-2008-3708
Disclosure Date: August 19, 2008 (last updated October 04, 2023)
Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) news/index.dot and (2) getting_started/macros/macros_detail.dot.
0
Attacker Value
Unknown
CVE-2008-2397
Disclosure Date: May 21, 2008 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
