CVE-2023-22857: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post...

PT-2023-18731 · Unknown · Blogengine.Net

Name of the Vulnerable Software and Affected Versions: BlogEngine.NET version 3.3.8.0 Description: A stored Cross-site Scripting XSS issue allows the injection of arbitrary JavaScript in the security context of a blog visitor through the upload of a specially crafted file. Recommendations: For...

CVE-2023-22856: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file...

PT-2023-18732 · Unknown · Blogengine.Net

Name of the Vulnerable Software and Affected Versions: BlogEngine.NET version 3.3.8.0 Description: A stored Cross-site Scripting XSS vulnerability allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

Design/Logic Flaw

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 contains a vulnerability that lets an attacker create any folder with a prefix of “files” under ~/App_Data/. The issue stems from improper validation/permissions around folder creation in BlogEngine.NET, enabling unauthorized directory creation. CVSS metrics in the primary...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-41417: Missing Authorization

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under /AppData/...

CVE-2022-41418

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

Design/Logic Flaw

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2022-41418

The CVE-2022-41418 entry concerns BlogEngine.NET v3.3.8.0, where the vulnerability lies in the UploadController.cs under BlogEngine/BlogEngine.NET/AppCode/Api. Uploading a crafted PNG can lead to arbitrary code execution on the server. The issue is rooted in the file upload handling, enabling rem...

CVE-2022-41418

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

PT-2022-25854 · Unknown · Blogengine.Net

Name of the Vulnerable Software and Affected Versions: BlogEngine.NET version 3.3.8.0 Description: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs allows attackers to execute arbitrary code via uploading a crafted PNG file. Recommendations: For BlogEngine.NET...

CVE-2022-41418

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2022-41418: Improper Limitation of a Pathname to a Restricted Directory

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...

CVE-2022-28921

A Cross-Site Request Forgery CSRF vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server...