CVE-2016-8902

Mô tả

Tham khảo

• seclists.org/fulldisclosure/2016/Nov/0 · Third Party Advisory
• securityfocus.com/bid/94311 · Technical Description
• dotCMS/core#8460 · Patch
• dotCMS/core#8468 · Patch
• security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html · Exploit

Lỗ hổng khác của dotcms

• CVE-2025-11165NGHIÊM TRỌNG 9.9A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileg…
• CVE-2024-3938TRUNG BÌNH 6.1The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it ca…
• CVE-2024-3165TRUNG BÌNH 4.5System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Neverthel…
• CVE-2024-3164TRUNG BÌNH 4.5In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is acce…
• CVE-2023-3042TRUNG BÌNH 6.1In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses…