287 matches found
CVE-2018-18325
Summary: CVE-2018-18325 affects DNN (DotNetNuke) platforms running version 9.2 through 9.2.2. The issue is an inadequate encryption strength for input parameters, arising from an incomplete fix for CVE-2018-15811. The vulnerability is tied to the use of a weak encryption algorithm in protecting i...
CVE-2018-18325
DNN aka DotNetNuke 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811...
CVE-2018-15812
CVE-2018-15812 affects DNN (DotNetNuke) versions 9.2 through 9.2.1. The issue arises from incorrect conversion of encryption key source values, yielding lower than expected entropy in keys. The documents describe related advisories (GHSA, OSV) and OpenVAS entries referencing the same entropy prob...
CVE-2018-15811
DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...
CVE-2018-15811
CVE-2018-15811 – DNN series (DotNetNuke) vulnerable to weak encryption . The provided sources confirm that DNN platforms running 9.2 through 9.2.2 use a weak encryption algorithm to protect input parameters (notably in cookies), representing a vulnerability in the protection of parameter data. Th...
CVE-2018-15811
DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...
CVE-2018-15811
DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
DNN (DotNetNuke) 7.0.0 < 9.3.1 Multiple Vulnerabilities
The version of DNN Platform formerly DotNetNuke running on the remote host is 7.0.0 or later but prior to 9.3.1. It is, therefore, affected by multiple vulnerabilities including the following: - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input befo...
CVE-2018-14486
DNN formerly DotNetNuke 9.1.1 allows cross-site scripting XSS via XML...
CVE-2018-14486
DNN formerly DotNetNuke 9.1.1 allows cross-site scripting XSS via XML...
Cross site scripting
DNN formerly DotNetNuke 9.1.1 allows cross-site scripting XSS via XML...
CVE-2018-14486
CVE-2018-14486 affects DNN (DotNetNuke) 9.1.1, where XML handling enables Cross-Site Scripting (XSS). The Red Hat and Snyk entries corroborate XSS in DNN 9.1.1 via XML, but the provided documents do not specify a fixed version or explicit remediation. Practical impact is XSS exposure in web appli...
CVE-2018-14486
DNN formerly DotNetNuke 9.1.1 allows cross-site scripting XSS via XML...
U.S. Dept Of Defense: RCE on https://█████/ Using CVE-2017-9248
Summary: https://█████████/ is hosting an unpatched version of the Telerik DialogHandler Telerik.Web.UI.DialogHandler.aspx allowing for the machine key to be brute forced. The machine key can be used to access the DNN file manager to upload arbitrary files including ASPX giving a web shell and RC...
DNN 9.1 XML Related Cross Site Scripting
Cross-site Scripting via XML Vulnerability in DNN 9.1 Information -------------------- Advisory by Netsparker Name: Cross-site Scripting via XML Vulnerability in DNN 9.1 Affected Software: DNN Affected Versions: 9.1 Homepage: http://dnnsoftware.com Vulnerability: Cross-site Scripting via XML...
U.S. Dept Of Defense: https://████████ Impacted by DNN ImageHandler SSRF
Summary: https://███████ runs DNN 8.0.0 to 9.1.1 and is impacted by CVE 2017-0929 allowing for a SSRF through the DNN ImageHandler. Origin servers will request any image file supplied by the attacker. This allows for internal NIPR sites to be mapped and accessed through a vulnerable host. The...
GHSA-X2RG-FMCV-CRQ5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie
DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...
CVE-2017-0929
DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...
Server side request forgery (ssrf)
DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...