DNN (aka DotNetNuke) has Remote Code Execution via a cookie

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

GHSA-X2RG-FMCV-CRQ5 DNN (aka DotNetNuke) has Remote Code Execution via a cookie

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 Critical Possible remote code execution on DNN sites."...

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

GHSA-5C66-X4WM-RJFX Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

Moderate severity vulnerability that affects DotNetNuke.Core

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-V76M-F5CX-8RG4 Moderate severity vulnerability that affects DotNetNuke.Core

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

GHSA-G8J6-M4P7-5RFQ High severity vulnerability that affects DotNetNuke.Core

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

DNN (DotNetNuke) 5.0.0 < 9.2.2 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 5.0.0 or later but prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities including a leaked cryptographic information vulnerability and a cross-site scripting vulnerability. An authenticated attacker...

PT-2018-3765 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN aka DotNetNuke versions 9.2 through 9.2.2 Description: The issue is related to the use of a weak encryption algorithm to protect input parameters, which could allow a remote attacker to gain unauthorized access to protected information...

PT-2018-3764 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN aka DotNetNuke versions 9.2 through 9.2.1 Description: The issue is related to the use of a weak encryption algorithm to protect input parameters, which can allow a remote attacker to gain unauthorized access to protected information...

Server-Side Request Forgery (SSRF)

DotNetNuke.Core is vulnerable to server-side request forgery SSRF attacks. The application does not properly handle images, allowing a malicious user to pass arbitrary URLs when generating an image that can allow an attacker to conduct a SSRF attack...

Server side request forgery (ssrf)

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

CVE-2017-0929

DNN aka DotNetNuke before 9.2.0 suffers from a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources...

CVE-2017-0929

The DotNetNuke (DNN) content management platform is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the DnnImageHandler class in versions prior to 9.2.0 . This vulnerability allows unauthenticated attackers to execute arbitrary GET requests against target systems, facilitating internal...

PT-2018-5156 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN aka DotNetNuke versions prior to 9.2.0 Description: The issue allows attackers to access information about internal network resources due to a Server-Side Request Forgery SSRF vulnerability in the DnnImageHandler class. Recommendations: F...

DNN CATALooK.netStore Module Cross-Site Scripting Vulnerability

DNN formerly known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich features such as CATALooK.netStore module is one of the CATALooK store module . A...

DotNetNuke 7.2.8 CATALooKStore Cross Site Scripting

Title: DotNetNuke CATALooKStore Cross Site Scripting XSS + Date: 2018/04/15 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: www.dnnsoftware.com + Tested on: Windows 10 & Kali Linux + Versions: 7.2.8 and Before + Vulnerable Parameter: Get Method + Vulnerable File:...