CVE-2013-7335

CVE-2013-7335 describes an open redirect vulnerability in DotNetNuke (DNN) prior to 6.2.9 and in 7.x prior to 7.1.1. The issue allows remote attackers to redirect users to arbitrary sites and potentially conduct phishing via unspecified vectors. Affected product is DotNetNuke (DNN); the root caus...

CVE-2013-4649

DotNetNuke (DNN) is affected by a cross-site scripting (XSS) vulnerability (CVE-2013-4649) in which user input to the __dnnVariable parameter on the default URI is not sanitized. Affected versions are DNN before 6.2.9 and 7.x before 7.1.1, enabling remote attackers to inject arbitrary script/HTML...

CVE-2012-1036

CVE-2012-1036 is an XSS vulnerability in DotNetNuke's Telerik HTML editor prior to 5.6.4 and 6.x prior to 6.1.0. The issue, triggered by specially crafted HTML/JavaScript in messages, could allow remote attackers to inject arbitrary script or HTML. Impact is explained as cross-site scripting with...

CVE-2013-3943

CVE-2013-3943 (DotNetNuke/DNN) — XSS in Display Name field . Affected: DNN versions before 6.2.9 and 7.x before 7.1.1. Description: remote authenticated users can inject arbitrary script/HTML via the Display Name in Manage Profile, indicating a persistent XSS vulnerability. Connection details fro...

CVE-2012-1030

CVE-2012-1030 concerns a Cross-Site Scripting (XSS) flaw in DotNetNuke 6.x up to 6.0.2. The issue arises from how script information is validated in a specially crafted URL used with a modal popup, allowing a user-assisted remote attacker to inject arbitrary script or HTML into a victim’s browser...