845 matches found
PT-2014-3373
Name of the Vulnerable Software and Affected Versions DotNetNuke DNN versions prior to 6.2.9 DotNetNuke DNN versions 7.x prior to 7.1.1 Description The issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. The exact vectors used for the...
PT-2014-2846
Name of the Vulnerable Software and Affected Versions DotNetNuke versions prior to 6.2.9 DotNetNuke versions 7.x prior to 7.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the dnnVariable parameter to the default URI. Recommendations...
PT-2014-2717
Name of the Vulnerable Software and Affected Versions DotNetNuke versions prior to 6.2.9 DotNetNuke versions 7.x prior to 7.1.1 Description A cross-site scripting issue allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the...
CVE-2013-7335: Improper Input Validation
Open redirect vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2013-4649: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the dnnVariable parameter to the default URI...
PT-2014-2906
Name of the Vulnerable Software and Affected Versions ZLDNN DNNArticle module versions prior to 10.1 for DotNetNuke Description The issue allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in the RSS page, specifically in the DNNArticleRSS.aspx file. This enabl...
CVE-2013-5117: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the RSS page DNNArticleRSS.aspx in the ZLDNN DNNArticle module before 10.1 for DotNetNuke allows remote attackers to execute arbitrary SQL commands via the categoryid parameter...
DotNetNuke DNNArticle模块'categoryid'参数SQL注入漏洞
BUGTRAQ ID: 61788 CVECAN ID: CVE-2013-5117 DotNetNuke DNNArticle是DNN的CMS和文章管理模块。 DNNArticle 10.0及之前版本没有正确验证categoryid参数值的有效性，存在SQL注入漏洞，成功利用后可使远程攻击者执行未授权数据库操作。 0 DotNetNuke DNNArticle 10.0 厂商补丁： DotNetNuke ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： www.dnnarticle.com...
DotNetNuke 6.x < 6.2.9, 7.x < 7.1.1 Redirection Weakness and XSS Vulnerabilities
DotNetNuke is prone to redirection weakness and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
DotNetNuke < 10.1 DNNArticle Module SQLi Vulnerability
DotNetNuke DNNArticle module is prone to a SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
DotNetNuke DNNArticle插件 10.0 /DesktopModules/DNNArticle/DNNArticleRSS.aspx SQL注入漏洞
No description provided by source...
DNN (DotNetNuke) DNNArticle Module categoryid Parameter SQL Injection
The version of DNN installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'categoryid' parameter of the 'dnnarticlerss.aspx' script. A remote, unauthenticated attacker can leverage this issue to launch a SQL...
DotNetNuke DNNArticle Module 10.0 - SQL Injection
DotNetNuke DNNArticle Module 10.0 - SQL Injection Title: DotNetNuke DNNArticle Module SQL Injection Vulnerability References: CVE-2013-5117 Discovered by: Sajjad Pourali Vendor http://www.zldnn.com/ , http://www.dnnarticle.com/ Vendor advisory:...
DotNetNuke DNNArticle Module 10.0 - SQL Injection
Title: DotNetNuke DNNArticle Module SQL Injection Vulnerability References: CVE-2013-5117 Discovered by: Sajjad Pourali Vendor http://www.zldnn.com/ , http://www.dnnarticle.com/ Vendor advisory: http://www.zldnn.com/Support/tabid/643/ctl/RecordList/mid/1691/ItemID/2979/Default.aspx Ticket iD:297...
DotNetNuke DNNArticle Module 10.0 - SQL Injection Vulnerability
Remote: yes Authentication required: no User interaction required: no Impact: High PoC: http://server/desktopmodules/dnnarticle/dnnarticlerss.aspx?moduleid=0&email protected@version 0day.today 2018-01-01...
DotNetNuke DNNArticle 10.0 SQL Injection
Title: DotNetNuke DNNArticle Module SQL Injection Vulnerability References: CVE-2013-5117 Discovered by: Sajjad Pourali Vendor http://www.zldnn.com/ , http://www.dnnarticle.com/ Vendor advisory: http://www.zldnn.com/Support/tabid/643/ctl/RecordList/mid/1691/ItemID/2979/Default.aspx Ticket iD:297...
DotNetNuke 6.1.x - Cross-Site Scripting
source: https://www.securityfocus.com/bid/61770/info DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...
DotNetNuke 6.1.x - Cross-Site Scripting
DotNetNuke 6.1.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/61770/info DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...
DotNetNuke (DNN) 7.1.0 / 6.2.8 Cross Site Scripting
Title: DotNetNuke DNN Cross-Site Scripting Vulnerability References: CVE-2013-4649 Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami Vendor http://dnnsoftware.com/ Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins 2013-07 Vendor contact: 2013-06-23 Vendor...