287 matches found
DNN (DotNetNuke) 6.2.x < 9.0.2 User Profile Information Disclosure
The version of DNN Platform formerly DotNetNuke running on the remote host is 6.2 or later but prior to 9.0.2. It is, therefore, affected by an unspecified flaw that allows an unauthenticated, remote attacker to disclose sensitive user profile property information. Note that Nessus has not tested...
CVE-2015-2794
DotNetNuke (DNN) prior to version 7.4.1 is affected: the installation wizard Install/InstallWizard.aspx can be accessed to reinstall the application and escalate to SuperUser. Root cause: post-installation installation wizard scripts not properly secured, enabling an unauthenticated remote bypass...
CVE-2016-7119
CVE-2016-7119 is a cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) affecting the user-profile biography area prior to version 8.0.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element, with impact descr...
DNN (DotNetNuke) < 8.0.4 Multiple Vulnerabilities
The version of DNN Platform formerly DotNetNuke running on the remote host is affected by multiple vulnerabilities : - A flaw exists due to improper validation of user permissions. An authenticated, remote attacker with permissions to edit a particular page can exploit this to make changes to sit...
DNN (DotNetNuke) < 8.0.1 Multiple Vulnerabilities
The version of DNN Platform formerly DotNetNuke running on the remote host is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of input to the 'returnurl' query string parameter before returning it to users. A remote attacker can...
DNN (DotNetNuke) < 7.4.2 Multiple Vulnerabilities
The version of DNN installed on the remote host is affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability exists due to a failure to properly sanitize content used by the tabs control. An unauthenticated, remote attacker can exploit this to execute arbitrary...
DNN (DotNetNuke) < 7.4.0 Unspecified Persistent XSS
The version of DNN installed on the remote host is affected by an unspecified, persistent cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...
CVE-2015-1566
CVE-2015-1566 affects DotNetNuke (DNN) before version 7.4.0, where an XSS flaw could allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The concrete root cause is not detailed in the provided documents beyond the vendor’s version bound; no exploit vectors are d...
DNN(DotNetNuke®) Iconbar Control Panel Bad Access Level config
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNNDotNetNuke® Iconbar Control Panel Bad Access Level config Author : alieye vendor : http://dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork: inurl:ctl/+inurl:/tab inurl:ctl+inurl:tab Model Module...
DNN(DotNetNuke®) Ribbon Bar Control Panel Bad Access Level config
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNNDotNetNuke® Ribbon Bar Control Panel Bad Access Level config Author : alieye vendor : http://dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork: inurl:ctl/+inurl:/tab inurl:ctl+inurl:tab Model...
DNN (DotNetNuke®) CodeEditor Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® CodeEditor Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.mediaant.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
DNN (DotNetNuke®) eventscalendar Module Arbitrary File Download Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® eventscalendar Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.invenmanager.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...
DNN (DotNetNuke) < 7.2.2 Unspecified XSS
The version of DNN installed on the remote host is affected by a unspecified cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...
CVE-2013-4649
DotNetNuke (DNN) is affected by a cross-site scripting (XSS) vulnerability (CVE-2013-4649) in which user input to the __dnnVariable parameter on the default URI is not sanitized. Affected versions are DNN before 6.2.9 and 7.x before 7.1.1, enabling remote attackers to inject arbitrary script/HTML...
CVE-2013-3943
CVE-2013-3943 (DotNetNuke/DNN) — XSS in Display Name field . Affected: DNN versions before 6.2.9 and 7.x before 7.1.1. Description: remote authenticated users can inject arbitrary script/HTML via the Display Name in Manage Profile, indicating a persistent XSS vulnerability. Connection details fro...
CVE-2013-7335
CVE-2013-7335 describes an open redirect vulnerability in DotNetNuke (DNN) prior to 6.2.9 and in 7.x prior to 7.1.1. The issue allows remote attackers to redirect users to arbitrary sites and potentially conduct phishing via unspecified vectors. Affected product is DotNetNuke (DNN); the root caus...
DNN (DotNetNuke) < 6.2.9 / 7.1.1 Multiple Vulnerabilities
The version of DNN installed on the remote host is affected by multiple vulnerabilities : - The application is affected by a persistent cross-site scripting vulnerability because input to the 'Display Name' in the 'Manage Profile' view is not properly sanitized. CVE-2013-3943 - The application is...
DNN (DotNetNuke) __dnnVariable Parameter XSS
The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the ' dnnVariable' parameter. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to inject arbitrary...
DotNetNuke (DNN) 7.1.0 / 6.2.8 Cross Site Scripting
Title: DotNetNuke DNN Cross-Site Scripting Vulnerability References: CVE-2013-4649 Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami Vendor http://dnnsoftware.com/ Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins 2013-07 Vendor contact: 2013-06-23 Vendor...
DNN (DotNetNuke) Language Flag Selector Culture XSS
The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to the application failing to properly sanitize user-supplied input when multiple languages are selected in the flag selector. An unauthenticated, remote attacker can exploit this, via a...