CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 1CVE-2013-3484
https://notcve.org/view.php?id=CVE-2013-3484
Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html, (2) my_account_login parameter to c/portal_public/login, or (3) email parameter to forgotPassword. Múltiples vulnerabilidades de XSS en dotCMS anterior a 2.3.2 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del (1) parámetro _loginUserName hacia application/login/login.html, (2) parámetro my_account_login hacia c/portal_public/login o (3) parámetro email hacia forgotPassword. • http://dotcms.com/security/SI-14 http://secunia.com/advisories/53265 https://github.com/dotCMS/dotCMS/issues/2949 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1826
https://notcve.org/view.php?id=CVE-2012-1826
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template. dotCMS v1.9 anteriores a v1.9.5.1 permite a usuarios remotos autenticados ejecutar código JAVA a través de las plantillas (1) XSLT o (2) Velocity manipuladas. • http://dotcms.com/dotCMSVersions http://osvdb.org/82240 http://secunia.com/advisories/49276 http://www.kb.cert.org/vuls/id/898083 http://www.securityfocus.com/bid/53688 https://gist.github.com/2627440 https://github.com/dotCMS/dotCMS/issues/261 https://github.com/dotCMS/dotCMS/issues/281 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 1CVE-2008-3708 – dotCMS 1.6 - 'id' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-3708
Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) news/index.dot and (2) getting_started/macros/macros_detail.dot. Múltiples vulnerabilidades de salto de directorio en dotCMS 1.6.0.9 permiten a atacantes remotos leer ficheros arbitrariamente mediante un .. (punto punto) en los parámetros id de (1) news/index.dot y (2) getting_started/macros/macros_detail.dot. • https://www.exploit-db.com/exploits/6247 http://secunia.com/advisories/31516 http://securityreason.com/securityalert/4163 http://www.securityfocus.com/bid/30703 https://exchange.xforce.ibmcloud.com/vulnerabilities/44491 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2008-2397
https://notcve.org/view.php?id=CVE-2008-2397
Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados en search-results.dot de dotCMS, permite a atacantes remotos, inyectar secuencias de comandos web o HTML a través del parámetro search_query. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • http://secunia.com/advisories/30307 http://www.securityfocus.com/bid/29287 https://exchange.xforce.ibmcloud.com/vulnerabilities/42525 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •