DNN(DotNetNuke®) Iconbar Control Panel Bad Access Level config

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNNDotNetNuke® Iconbar Control Panel Bad Access Level config Author : alieye vendor : http://dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork: inurl:ctl/+inurl:/tab inurl:ctl+inurl:tab Model Module...

DNN (DotNetNuke®) eventscalendar Module Arbitrary File Download Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® eventscalendar Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.invenmanager.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...

DNN (DotNetNuke®) CodeEditor Module Arbitrary File Download Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Title : DNN DotNetNuke® CodeEditor Module Arbitrary File Download Vulnerability Author : alieye vendor : http://www.mediaant.com/ , http://store.dnnsoftware.com/ Contact : [email protected] Risk : High Class: Remote Google Dork:...

DNN (DotNetNuke) < 7.2.2 Unspecified XSS

The version of DNN installed on the remote host is affected by a unspecified cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

CVE-2013-3943

CVE-2013-3943 (DotNetNuke/DNN) — XSS in Display Name field . Affected: DNN versions before 6.2.9 and 7.x before 7.1.1. Description: remote authenticated users can inject arbitrary script/HTML via the Display Name in Manage Profile, indicating a persistent XSS vulnerability. Connection details fro...

CVE-2013-4649

DotNetNuke (DNN) is affected by a cross-site scripting (XSS) vulnerability (CVE-2013-4649) in which user input to the __dnnVariable parameter on the default URI is not sanitized. Affected versions are DNN before 6.2.9 and 7.x before 7.1.1, enabling remote attackers to inject arbitrary script/HTML...

CVE-2013-7335

CVE-2013-7335 describes an open redirect vulnerability in DotNetNuke (DNN) prior to 6.2.9 and in 7.x prior to 7.1.1. The issue allows remote attackers to redirect users to arbitrary sites and potentially conduct phishing via unspecified vectors. Affected product is DotNetNuke (DNN); the root caus...

CVE-2013-3943: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile...

CVE-2013-7335: Improper Input Validation

Open redirect vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

DNN (DotNetNuke) < 6.2.9 / 7.1.1 Multiple Vulnerabilities

The version of DNN installed on the remote host is affected by multiple vulnerabilities : - The application is affected by a persistent cross-site scripting vulnerability because input to the 'Display Name' in the 'Manage Profile' view is not properly sanitized. CVE-2013-3943 - The application is...

DNN (DotNetNuke) __dnnVariable Parameter XSS

The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the ' dnnVariable' parameter. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to inject arbitrary...

DotNetNuke (DNN) 7.1.0 / 6.2.8 Cross Site Scripting

Title: DotNetNuke DNN Cross-Site Scripting Vulnerability References: CVE-2013-4649 Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami Vendor http://dnnsoftware.com/ Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins 2013-07 Vendor contact: 2013-06-23 Vendor...

DNN (DotNetNuke) Language Flag Selector Culture XSS

The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to the application failing to properly sanitize user-supplied input when multiple languages are selected in the flag selector. An unauthenticated, remote attacker can exploit this, via a...

DNN (DotNetNuke) < 5.3.0 SearchResults.aspx XSS

The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the 'Search' parameter of the 'SearchResults.aspx' script before using it to generate dynamic HTML output. An unauthenticated, remote...

DNN (DotNetNuke) Detection

The remote web server is running DNN formerly known as DotNetNuke, a web application framework written in ASP.NET. Note that this plugin can attempt to log into the application and obtain version information if supplied with credentials for a user with superuser privileges. C Tenable Network...

DNN / DotNetNuke Detection (HTTP)

HTTP based detection of DNN formerly DotNetNuke. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-1366

CVE-2009-1366 corresponds to a Cross-site Scripting (XSS) vulnerability in DotNetNuke (DNN) prior to 4.9.3, specifically in Website\admin\Sales\paypalipn.aspx. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to name/value pairs and PayPal I...

CVE-2007-0660: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...

CVE-2006-3601

UNVERIFIABLE Unspecified vulnerability in an unspecified DNN Modules module for DotNetNuke .net nuke allows remote attackers to gain privileges via unspecified vectors, as used in an attack against the Microsoft France web site. NOTE: due to the lack of details and uncertainty about which product...

CVE-2006-3601

The CVE-2006-3601 entry concerns DotNetNuke (.net nuke) via a DotNetNuke add-on (BDPDT) used by DotNetNuke modules. The connected Nessus document describes a specific vulnerability in BDPDT used by multiple DotNetNuke add-ons where an ASP.NET script UploadFilePopUp.aspx allows uploading arbitrary...