808 matches found
dotnetnuke-xss.txt
www.BugReport.ir AmnPardaz Security Research Team Title: Dot Net Nuke DNN XSS Vulnerability. Vendor: www.dotnetnuke.com Vulnerable Version: 4.8.3 and prior versions Exploit: N/A Impact: Low Fix: N/A Original Advisory: http://bugreport.ir/index.php?/38 1. Description: DotNetNuke is an open source...
DNN (DotNetNuke) Upgrade Process ValidationKey Generation Weakness Privilege Escalation
The version of DNN installed on the remote host appears to be using a default machine key, both 'ValidationKey' and 'DecryptionKey', for authentication token encryption and validation. A remote attacker can leverage this issue to bypass authentication and gain administrative access to the affecte...
DotNetNuke Default Machine Key Exposure
=========================================================== DotNetNuke Default Machine Key Exposure Public Release Date: March 20, 2008 Brian Holyfield - Gotham Digital Science [email protected] Affected Software: DotNetNuke = 4.8.1 Severity: Critical...
dotnetnuke-expose.txt
=========================================================== DotNetNuke Default Machine Key Exposure Public Release Date: March 20, 2008 Brian Holyfield - Gotham Digital Science [email protected] Affected Software: DotNetNuke = 4.8.1 Severity: Critical...
DotNetNuke 4.8.1 - Default ValidationKey and DecriptionKey Weak Encryption
DotNetNuke 4.8.1 - Default ValidationKey and DecriptionKey Weak Encryption source: https://www.securityfocus.com/bid/28391/info DotNetNuke is prone to a weak encryption vulnerability. An attacker can exploit this issue to decrypt sensitive data. Information obtained may lead to further attacks...
DotNetNuke 4.8.1 - Default 'ValidationKey' and 'DecriptionKey' Weak Encryption
source: https://www.securityfocus.com/bid/28391/info DotNetNuke is prone to a weak encryption vulnerability. An attacker can exploit this issue to decrypt sensitive data. Information obtained may lead to further attacks. This issue affects DotNetNuke 4.8.1; other versions may also be affected. //...
CVE-2007-0660
Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...
Cross site scripting
Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...
CVE-2007-0660
The CVE-2007-0660 issue affects the DotNetNuke (DNN) IFrame module prior to version 03.02.01. The vulnerability stems from improper validation of user-supplied input in the pass-through values, leaving them unfiltered and susceptible to XSS. A remote attacker can exploit this by using crafted URL...
CVE-2007-0660
Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...
CVE-2007-0660: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the IFrame module before 03.02.01 for DotNetNuke DNN allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "Pass through values."...
CVE-2006-4973
Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...
CVE-2006-4973
Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...
CVE-2006-4973
DotNetNuke (Perpetual Motion Interactive Systems) has a reflected XSS vulnerability in Default.aspx: versions prior to 3.3.5 and 4.x prior to 4.3.5 allow remote attackers to inject arbitrary HTML via the error parameter. Affected software is DotNetNuke under Perpetual Motion Interactive Systems. ...
PT-2006-5716 · Perpetual Motion Interactive Systems · Dotnetnuke
Name of the Vulnerable Software and Affected Versions: Perpetual Motion Interactive Systems DotNetNuke versions prior to 3.3.5 Perpetual Motion Interactive Systems DotNetNuke versions 4.x prior to 4.3.5 Description: A cross-site scripting issue allows remote attackers to inject arbitrary HTML via...
CVE-2006-4973: Undefined Security Weakness
Cross-site scripting XSS vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter...
[SA22051] DotNetNuke "error" Parameter Cross-Site Scripting Vulnerability
TITLE: DotNetNuke "error" Parameter Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA22051 VERIFY ADVISORY: http://secunia.com/advisories/22051/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: DotNetNuke 4.x http://secunia.com/product/12059/ DotNetNuke 3...
[Full-disclosure] DotNetNuke HTML Code Injection
Security Advisory: VULN20-09-2006 - http://www.secureshapes.com/advisories/vuln20-09-2006.htm Vendor Security Bulletin: http://dotnetnuke.com/About/WhatIsDotNetNuke/SecurityPolicy/SecurityBulletin no3/tabid/990/Default.aspx DotNetNuke - HTML Code Injection Vulnerability Date: 20/09/2006 Severity:...
DotNetNuke 4.0 - HTML Injection
DotNetNuke 4.0 - HTML Injection source: https://www.securityfocus.com/bid/20117/info DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script co...
DotNetNuke 4.0 - HTML Injection
source: https://www.securityfocus.com/bid/20117/info DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code may execute in the context of...