CVE-2017-0929

CVE-2017-0929 affects DotNetNuke (DNN) before 9.2.0. A Server-Side Request Forgery (SSRF) vulnerability exists in the DnnImageHandler class, enabling an attacker to access internal network resources. The issue is mitigated by upgrading DNN to version 9.2.0 or above. If exploiting details are prov...

Design/Logic Flaw

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

CVE-2018-10138

The CATALooK.netStore module through 7.2.8 for DNN formerly DotNetNuke allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter, or the /ImageViewer.aspx link or desc parameter...

CVE-2018-10138

The CVE-2018-10138 entry affects the CATALooK.netStore module for DotNetNuke/DNN up to version 7.2.8. The vulnerability is a cross-site scripting (XSS) flaw exploitable via user-controlled input in the /ViewEditGoogleMaps.aspx (PortalID or CATSkin parameter) or /ImageViewer.aspx (link or desc par...

CVE-2018-9126

The DNNArticle module 11 for DNN formerly DotNetNuke allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI...

Code injection

The DNNArticle module 11 for DNN formerly DotNetNuke allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI...

CVE-2018-9126

The DNNArticle module 11 for DNN formerly DotNetNuke allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI...

CVE-2018-9126

CVE-2018-9126 affects the DNNArticle module 11 for DotNetNuke. The vulnerability allows remote attackers to read the web.config via the URI /GetCSS.ashx/?CP=%2fweb.config, exposing database credentials and other config data. Exploit references exist (Exploit-DB, PacketStorm), confirming in-the-wi...

CVE-2018-9126

The DNNArticle module 11 for DNN formerly DotNetNuke allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI...

DotNetNuke arbitrary code execution vulnerability(CVE-2017-9822)

0x00 background description DNN uses web cookies to identify users. A malicioususer can decode one of such cookies and identify who that user is, and possiblyimpersonate other users and even upload malicious code to the server. --DNNsecurity-center 2017 7 November 5, DNN security sector released ...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

Remote code execution

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

CVE-2017-9822

DotNetNuke (DNN) cookie deserialization RCE (CVE-2017-9822) affects DNN before 9.1.1. The vulnerability arises from deserializing a crafted DNNPersonalization-like cookie, enabling remote code execution. Exploitation details and public proof points are documented in exploit references (e.g., Meta...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka “2017-08 Critical Possible remote code execution on DNN sites.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

DNN (DotNetNuke) 3.0.0 < 9.1.0 SWF File Handling XSS

The version of DNN Platform formerly DotNetNuke running on the remote host is 3.0.0 or later but prior to 9.1.0. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input when handling SWF files. An unauthenticated, remote attacker ca...

DNN (DotNetNuke) < 7.4.1 Administration Authentication Bypass Vulnerability

The version of DNN formerly DotNetNuke running on the remote web server is prior to 7.4.1. It is, therefore, affected by an authentication bypass vulnerability due to a failure to delete installation wizard scripts post-installation. An unauthenticated, remote attacker can exploit this, via a...