CVE-2007-0660

Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...

CVE-2007-0660

The CVE-2007-0660 issue affects the DotNetNuke (DNN) IFrame module prior to version 03.02.01. The vulnerability stems from improper validation of user-supplied input in the pass-through values, leaving them unfiltered and susceptible to XSS. A remote attacker can exploit this by using crafted URL...

CVE-2007-0660: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...

CVE-2006-4973

Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...

CVE-2006-4973

Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...

CVE-2006-4973

DotNetNuke (Perpetual Motion Interactive Systems) has a reflected XSS vulnerability in Default.aspx: versions prior to 3.3.5 and 4.x prior to 4.3.5 allow remote attackers to inject arbitrary HTML via the error parameter. Affected software is DotNetNuke under Perpetual Motion Interactive Systems. ...

PT-2006-5716 · Perpetual Motion Interactive Systems · Dotnetnuke

Name of the Vulnerable Software and Affected Versions: Perpetual Motion Interactive Systems DotNetNuke versions prior to 3.3.5 Perpetual Motion Interactive Systems DotNetNuke versions 4.x prior to 4.3.5 Description: A cross-site scripting issue allows remote attackers to inject arbitrary HTML via...

CVE-2006-4973: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...

[SA22051] DotNetNuke "error" Parameter Cross-Site Scripting Vulnerability

TITLE: DotNetNuke "error" Parameter Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA22051 VERIFY ADVISORY: http://secunia.com/advisories/22051/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: DotNetNuke 4.x http://secunia.com/product/12059/ DotNetNuke 3...

[Full-disclosure] DotNetNuke HTML Code Injection

Security Advisory: VULN20-09-2006 - http://www.secureshapes.com/advisories/vuln20-09-2006.htm Vendor Security Bulletin: http://dotnetnuke.com/About/WhatIsDotNetNuke/SecurityPolicy/SecurityBulletin no3/tabid/990/Default.aspx DotNetNuke - HTML Code Injection Vulnerability Date: 20/09/2006 Severity:...

DotNetNuke 4.0 - HTML Injection

DotNetNuke 4.0 - HTML Injection source: https://www.securityfocus.com/bid/20117/info DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script co...

DotNetNuke 4.0 - HTML Injection

source: https://www.securityfocus.com/bid/20117/info DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code may execute in the context of...

CVE-2006-3601

UNVERIFIABLE Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke .net nuke allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and uncertainty about which product...

CVE-2006-3601

The CVE-2006-3601 entry concerns DotNetNuke (.net nuke) via a DotNetNuke add-on (BDPDT) used by DotNetNuke modules. The connected Nessus document describes a specific vulnerability in BDPDT used by multiple DotNetNuke add-ons where an ASP.NET script UploadFilePopUp.aspx allows uploading arbitrary...

CVE-2006-3601: Undefined Security Weakness

UNVERIFIABLE Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke .net nuke allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and uncertainty about which product...

BDPDT for DotNetNuke (.net nuke) uploadfilepopup.aspx File Upload Privilege Escalation

The remote host contains BDPDT, a database abstraction layer used in various add-on modules for DotNetNuke. The installed version of the BDPDT contains an ASP.NET script that allows an unauthenticated attacker to gain control of the affected host by allowing uploading arbitrary files with the...

DotNetNuke < 3.0.12 Multiple HTML Injection Vulnerabilities

DotNetNuke contains several input validation flaws leading to the execution of attacker supplied HTML and script code. SPDX-FileCopyrightText: 2005 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2004-2323

DotNetNuke (formerly IBuySpy Workshop) 1.0.6–1.0.10d is affected. A remote attacker can obtain sensitive information, including the SQL server username and password, by performing a GET request for source or configuration files such as Web.config. This vulnerability exposes credentials and arises...

CVE-2004-2324

DotNetNuke (formerly IBuySpy Workshop) 1.0.6–1.0.10d is affected by an SQL injection vulnerability in LinkClick.aspx, exploitable via the (1) table and (2) field parameters to modify the backend database. The vulnerability allows remote attackers to alter database contents. Documents do not provi...

CVE-2004-2323

DotNetNuke formerly IBuySpy Workshop 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config...