CVE-2008-6540

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default 1 ValidationKey and 2 DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys...

Design/Logic Flaw

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default 1 ValidationKey and 2 DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys...

CVE-2008-6540

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default 1 ValidationKey and 2 DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys...

CVE-2008-6542

Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files...

CVE-2008-6541

The CVE-2008-6541 entry describes an unrestricted file upload vulnerability in the DotNetNuke file manager module prior to version 4.8.2. Remote administrators could upload arbitrary files and gain server privileges via unspecified vectors. Affected product: DotNetNuke, component: file manager mo...

CVE-2008-6540

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default 1 ValidationKey and 2 DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys...

CVE-2008-6542

CVE-2008-6542 affects DotNetNuke’s Skin Manager prior to 4.8.2. The vulnerability allows a remote authenticated administrator to trigger server-side execution of application logic by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM/HTML files. The...

CVE-2008-6540

DotNetNuke prior to 4.8.2 stores default ValidationKey and DecryptionKey in web.config during installation or upgrade. This weak configuration allows remote attackers to bypass access restrictions by using the default keys. Impact: potential authentication/authorization bypass. Mitigation: upgrad...

CVE-2008-6541

Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors...

CVE-2008-6399

Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors...

Code injection

Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors...

CVE-2008-6399

Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors...

CVE-2008-6399

CVE-2008-6399 affects DotNetNuke versions 4.5.2 through 4.9, describing an unspecified vulnerability that allows remote attackers to add additional roles to their user account via unknown attack vectors. The available references confirm the vendor advisories but do not reveal the exact attack vec...

CVE-2008-6399

Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors...

DotNetNuke Default.aspx跨站脚本漏洞

BUGTRAQ ID: 29437 DotNetNuke（DNN）是免费的开源内容管理系统。 DotNetNuke的Default.aspx页面没有正确地过滤用户通过URL提交的输入，远程攻击者可以提交恶意URL请求执行跨站脚本攻击。 0 DotNetNuke 4.8.3 DotNetNuke ---------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： a href=http://www.dotnetnuke.com/ target=blankhttp://www.dotnetnuke.com//a...

DotNetNuke 4.8.3 - Default.aspx Cross-Site Scripting

DotNetNuke 4.8.3 - Default.aspx Cross-Site Scripting source: https://www.securityfocus.com/bid/29437/info DotNetNuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

dotnetnuke-xss.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Dot Net Nuke DNN XSS Vulnerability. Vendor: www.dotnetnuke.com Vulnerable Version: 4.8.3 and prior versions Exploit: N/A Impact: Low Fix: N/A Original Advisory: http://bugreport.ir/index.php?/38 1. Description: DotNetNuke is an open source...

DotNetNuke 4.8.3 - 'Default.aspx' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29437/info DotNetNuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in t...

DNN (DotNetNuke) Upgrade Process ValidationKey Generation Weakness Privilege Escalation

The version of DNN installed on the remote host appears to be using a default machine key, both 'ValidationKey' and 'DecryptionKey', for authentication token encryption and validation. A remote attacker can leverage this issue to bypass authentication and gain administrative access to the affecte...

DotNetNuke Default Machine Key Exposure

=========================================================== DotNetNuke Default Machine Key Exposure Public Release Date: March 20, 2008 Brian Holyfield - Gotham Digital Science [email protected] Affected Software: DotNetNuke = 4.8.1 Severity: Critical...