CVE-2016-8600

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-254CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-86027.8The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash)CVE-2016-86055.3The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, otCVE-2016-86069.8The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.CVE-2016-86085.4JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5CVE-2016-86098.1It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a CVE-2016-86107.5A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processiCVE-2016-86116.5A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST CVE-2016-86124.3Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in thCVE-2016-86136.1A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitCVE-2016-86147.5A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary toCVE-2016-86157.5A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequCVE-2016-86165.9A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and pass
CVE-2016-8600: High severity, CVSS 7.5 | Vulnix