Vulnerabilities > Dotcms > Dotcms > 2.3

DATE CVE VULNERABILITY TITLE RISK
2022-08-05 CVE-2022-37431 Cross-site Scripting vulnerability in Dotcms
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06.
network
low complexity
dotcms CWE-79
6.1
2021-09-08 CVE-2020-19138 Unrestricted Upload of File with Dangerous Type vulnerability in Dotcms
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".
network
low complexity
dotcms CWE-434
critical
10.0
2021-08-18 CVE-2020-18875 Injection vulnerability in Dotcms
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
network
low complexity
dotcms CWE-74
8.8
2020-12-30 CVE-2020-27848 SQL Injection vulnerability in Dotcms
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter.
network
low complexity
dotcms CWE-89
6.5
2020-02-05 CVE-2020-6754 Path Traversal vulnerability in Dotcms
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control.
network
low complexity
dotcms CWE-22
7.5
2019-06-18 CVE-2019-12872 SQL Injection vulnerability in Dotcms
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.
network
low complexity
dotcms CWE-89
6.5
2019-05-23 CVE-2019-12309 Path Traversal vulnerability in Dotcms
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files.
network
low complexity
dotcms CWE-22
4.0
2019-03-07 CVE-2018-17422 Open Redirect vulnerability in Dotcms
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
network
dotcms CWE-601
5.8
2018-11-26 CVE-2018-19554 Cross-site Scripting vulnerability in Dotcms
An issue was discovered in Dotcms through 5.0.3.
network
low complexity
dotcms CWE-79
5.4
2018-07-24 CVE-2017-3189 Unrestricted Upload of File with Dangerous Type vulnerability in Dotcms
The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload.
network
dotcms CWE-434
critical
9.3