CVE-2013-7335

CVE-2013-7335 describes an open redirect vulnerability in DotNetNuke (DNN) prior to 6.2.9 and in 7.x prior to 7.1.1. The issue allows remote attackers to redirect users to arbitrary sites and potentially conduct phishing via unspecified vectors. Affected product is DotNetNuke (DNN); the root caus...

CVE-2013-4649

DotNetNuke (DNN) is affected by a cross-site scripting (XSS) vulnerability (CVE-2013-4649) in which user input to the __dnnVariable parameter on the default URI is not sanitized. Affected versions are DNN before 6.2.9 and 7.x before 7.1.1, enabling remote attackers to inject arbitrary script/HTML...

CVE-2010-4514

CVE-2010-4514 is an XSS vulnerability in DotNetNuke 5.05.01 and 5.06.00, affecting Install/InstallWizard.aspx. The underlying issue is improper handling of the __VIEWSTATE parameter, allowing remote attackers to inject arbitrary web script or HTML. Limited by the provided docs, exploitation statu...

CVE-2013-3943

CVE-2013-3943 (DotNetNuke/DNN) — XSS in Display Name field . Affected: DNN versions before 6.2.9 and 7.x before 7.1.1. Description: remote authenticated users can inject arbitrary script/HTML via the Display Name in Manage Profile, indicating a persistent XSS vulnerability. Connection details fro...