CVE-2020-5186

DNN formerly DotNetNuke through 9.4.4 allows XSS issue 1 of 2...

CVE-2020-5187

DNN formerly DotNetNuke through 9.4.4 allows Path Traversal issue 2 of 2...

CVE-2020-5187

CVE-2020-5187 affects DNN (DotNetNuke) up to version 9.4.4, where path traversal was reported. Multiple connected sources describe a zip-slip/path-traversal issue arising from unsafe handling/validation of file paths during archive extraction, enabling an attacker to access or overwrite files out...

CVE-2020-5188

CVE-2020-5188 affects DNN (DotNetNuke) up to version 9.4.4, where an insecure permissions issue is reported. The root cause is improper/weak permission handling within the DNN platform, enabling a scenario where an attacker could abuse file permissions (as indicated by CVSS details with high inte...

CVE-2020-5188

DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...

DotNetNuke 9.5 - Persistent Cross-Site Scripting

DotNetNuke 9.5 - Persistent Cross-Site Scripting Exploit Title: DotNetNuke 9.5 - Persistent Cross-Site Scripting Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

DotNetNuke CMS 9.4.4 Zip Directory Traversal

Exploit Title: Zip Slip vulnerability Date: 23 Feb 2020 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.4.4/DNNPlatform9.4.4Install.zip Version: = 9.4.4 CVE : CVE-2020-5187 More Info:...

CVE-2019-19392

The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...

Design/Logic Flaw

The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...

CVE-2019-19392

The CVE-2019-19392 issue affects the forDNN.UsersExportImport module for DNN (DotNetNuke) prior to version 1.2.0. An unprivileged user can import (create) new users with Administrator privileges by supplying Roles="Administrators" in XML or CSV data, enabling elevation of privilege. The connected...

CVE-2019-19392

The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...

DNN (DotNetNuke) 6.0.0 <= 9.3.2 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 6.0.0 or later but prior or equal to 9.3.2. It is, therefore, affected by multiple vulnerabilities including the following: - An unauthorized file access vulnerability exists due to insufficient verification of dynamic...

CVE-2019-12562

Stored Cross-Site Scripting in DotNetNuke DNN Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to...

CVE-2019-12562

CVE-2019-12562 describes a stored cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) prior to version 9.4.0. The issue affects the admin notification function and can allow an attacker to embed malicious scripts by exploiting the Display Name field on the notification page, with exploit...

Information Disclosure

DNN DotNetNuke is vulnerable to information disclosure. The use of a lower-than-expected entropy caused by an incorrect convertion of the encryption key source values allow attackers to retrieve confidential information. This vulnerability exists due to an incomplete fix for CVE-2018-15812...

CVE-2018-15812

DNN aka DotNetNuke 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy...

CVE-2018-18325

DNN aka DotNetNuke 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811...

CVE-2018-15811

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...

Code injection

DNN aka DotNetNuke 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy...

CVE-2018-18326

Summary: CVE-2018-18326 affects DNN (DotNetNuke) 9.2 through 9.2.2, which incorrectly converts encryption key source values, yielding lower entropy. This issue is noted as stemming from an incomplete fix for CVE-2018-15812. The connected sources identify the vulnerable versions and link to relate...