341 matches found
PT-2020-18291
Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke versions through 9.4.4 Description The issue concerns insecure permissions and a file upload vulnerability via bypassing client-side file extension checks. Recommendations For versions through 9.4.4, update to a version...
CVE-2020-5186: Improper Neutralization of Input During Web Page Generation
DNN formerly DotNetNuke through 9.4.4 allows XSS issue 1 of 2...
CVE-2020-5188: Unrestricted Upload of File with Dangerous Type
DNN formerly DotNetNuke through 9.4.4 has Insecure Permissions...
CVE-2020-5187: Improper Limitation of a Pathname to a Restricted Directory
DNN formerly DotNetNuke through 9.4.4 allows Path Traversal issue 2 of 2...
DotNetNuke CMS 9.4.4 Zip Directory Traversal
Exploit Title: Zip Slip vulnerability Date: 23 Feb 2020 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.4.4/DNNPlatform9.4.4Install.zip Version: = 9.4.4 CVE : CVE-2020-5187 More Info:...
PT-2020-18290
Name of the Vulnerable Software and Affected Versions DNN formerly DotNetNuke versions 9.4.4 and earlier Description The issue allows Path Traversal via unsafe handling of zip files. This means that an attacker could potentially access files outside the intended directory structure by manipulatin...
DotNetNuke 9.5 - Persistent Cross-Site Scripting
DotNetNuke 9.5 - Persistent Cross-Site Scripting Exploit Title: DotNetNuke 9.5 - Persistent Cross-Site Scripting Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...
CVE-2019-19392
The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...
Design/Logic Flaw
The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...
CVE-2019-19392
The CVE-2019-19392 issue affects the forDNN.UsersExportImport module for DNN (DotNetNuke) prior to version 1.2.0. An unprivileged user can import (create) new users with Administrator privileges by supplying Roles="Administrators" in XML or CSV data, enabling elevation of privilege. The connected...
CVE-2019-19392
The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...
CVE-2019-19392: Incorrect Default Permissions
The forDNN.UsersExportImport module before 1.2.0 for DNN formerly DotNetNuke allows an unprivileged user to import create new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data...
DNN (DotNetNuke) 6.0.0 <= 9.3.2 Multiple Vulnerabilities
The version of DNN Platform formerly DotNetNuke running on the remote host is 6.0.0 or later but prior or equal to 9.3.2. It is, therefore, affected by multiple vulnerabilities including the following: - An unauthorized file access vulnerability exists due to insufficient verification of dynamic...
CVE-2019-12562
Stored Cross-Site Scripting in DotNetNuke DNN Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to...
CVE-2019-12562
CVE-2019-12562 describes a stored cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) prior to version 9.4.0. The issue affects the admin notification function and can allow an attacker to embed malicious scripts by exploiting the Display Name field on the notification page, with exploit...
CVE-2019-12562: Improper Neutralization of Input During Web Page Generation
Stored Cross-Site Scripting in DotNetNuke DNN Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to...
Information Disclosure
DNN DotNetNuke is vulnerable to information disclosure. The use of a lower-than-expected entropy caused by an incorrect convertion of the encryption key source values allow attackers to retrieve confidential information. This vulnerability exists due to an incomplete fix for CVE-2018-15812...
CVE-2018-15811
DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...