DNN Cross-Site Scripting Vulnerability

DNN formerly known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN 9.1 version of the cross-site scripting vulnerability , remote attackers...

DotNetNuke Events Calendar 1.x File Download

Exploit Title : DNNSoftware EventsCalendar Modules 1.x Arbitrary File Download Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/01/2019 Vendor Homepage : dnnsoftware.com Software Information Link : store.dnnsoftware.com/home/product-details/events-calendar...

Cross-Site Scripting (XSS)

DotNetNuke.Core is vulnerable to cross-site scripting. A remote authenticated attacker is able to inject arbitrary Javascript via the Display Name field under Manage Profile...

DNN (aka DotNetNuke) has Remote Code Execution via a cookie

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

GHSA-X2RG-FMCV-CRQ5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

GHSA-5C66-X4WM-RJFX Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

Moderate severity vulnerability that affects DotNetNuke.Core

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-V76M-F5CX-8RG4 Moderate severity vulnerability that affects DotNetNuke.Core

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

GHSA-G8J6-M4P7-5RFQ High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

DNN (DotNetNuke) 5.0.0 < 9.2.2 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 5.0.0 or later but prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities including a leaked cryptographic information vulnerability and a cross-site scripting vulnerability. An authenticated attacker...

PT-2018-3765 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN aka DotNetNuke versions 9.2 through 9.2.2 Description: The issue is related to the use of a weak encryption algorithm to protect input parameters, which could allow a remote attacker to gain unauthorized access to protected information...

PT-2018-3764 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN aka DotNetNuke versions 9.2 through 9.2.1 Description: The issue is related to the use of a weak encryption algorithm to protect input parameters, which can allow a remote attacker to gain unauthorized access to protected information...

Server-Side Request Forgery (SSRF)

DotNetNuke.Core is vulnerable to server-side request forgery SSRF attacks. The application does not properly handle images, allowing a malicious user to pass arbitrary URLs when generating an image that can allow an attacker to conduct a SSRF attack...

Server side request forgery (ssrf)

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

CVE-2017-0929

The DotNetNuke (DNN) content management platform is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the DnnImageHandler class in versions prior to 9.2.0 . This vulnerability allows unauthenticated attackers to execute arbitrary GET requests against target systems, facilitating internal...

CVE-2017-0929

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...