Search criteria
84 vulnerabilities found for dotnetnuke by dotnetnuke
FKIE_CVE-2015-2794
Vulnerability from fkie_nvd - Published: 2017-02-06 15:59 - Updated: 2025-04-20 01:37
Severity ?
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "35404D75-9874-42E9-AEFB-9331D36CA967",
"versionEndIncluding": "07.04.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
},
{
"lang": "es",
"value": "El asistente de instalaci\u00f3n en DotNetNuke (DNN) en versiones anteriores a 7.4.1 permite a atacantes remotos reinstalar la aplicaci\u00f3n y obtener acceso SuperUser a trav\u00e9s de una solicitud directa a Install/InstallWizard.aspx."
}
],
"id": "CVE-2015-2794",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-06T15:59:00.137",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/39777/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2016-7119
Vulnerability from fkie_nvd - Published: 2016-08-31 14:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC861D69-9CCC-4F05-BBD4-889C157866EB",
"versionEndIncluding": "08.00.04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la secci\u00f3n de biograf\u00eda del perfil del usuario en DotNetNuke (DNN) en versiones anteriores a 8.0.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un atributo onclick manipulado en un elemento IMG."
}
],
"id": "CVE-2016-7119",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T14:59:01.190",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92719"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92719"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2015-1566
Vulnerability from fkie_nvd - Published: 2015-02-09 17:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "87403644-9E30-4F91-9473-B72E376AA38F",
"versionEndIncluding": "07.03.04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 7.4.0 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2015-1566",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-02-09T17:59:10.687",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/62832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/62832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-4649
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F2735AE-9598-42F5-B7CB-66C7502C397F",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4300BB9D-1A72-4005-AA68-35DB57A551E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "797726FF-24E9-415A-AC8B-2AE3301F8824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC6BB8DE-9497-42D7-A29D-BCAC75337A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "54AB8E47-5484-4449-88BA-90F0CCED285A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "B111556A-56AC-413C-A1B7-D973492BA8F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "FE94AE61-4CA4-48B5-BB08-D808CF750CFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C7863328-514C-4885-B5DD-5E04503962E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "750F735B-1419-4FCF-84F0-05E13608B73D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BF8EC31D-9C28-46D7-83C6-9720AA0DBC1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "81D4BDCE-EF83-48E2-BDC7-F6F6CE5CE51F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A5E7E9-4530-4CA9-BD61-4A22D17A898F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D7DEB2BD-8543-4408-B96E-616AFEBEEB12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "72A73BE5-6668-484E-8E7C-16E839E98882",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "31D0AA24-9FA3-4AFD-920A-295898473918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "34AF4B04-B86C-4BD0-94D9-3157AC55E542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB3D130-5DC4-4FE6-B178-EF1638E3A43D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68F28416-0ABF-4B2F-87A4-C4EC4D0CA227",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F1681BA4-9C05-45DF-B51B-D89633EB0C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "884BA1BF-BD03-4437-A02C-825B59634A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C627743E-9B8B-431B-A513-89CBF7C1E742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "677B54A1-6945-459F-9ADA-D6D9E89F2436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D101EF-4506-45D8-9717-5EE9A99B0A43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7059E6A-4A54-4364-8977-400C18905D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92A018EB-3C16-44BB-A872-E80D6F165395",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1285FF8E-EDB0-4C50-815B-DE40B1786601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "625C6564-F098-4C9B-AFE7-6686275A1016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6293D07D-4C07-4A5D-9532-455A7D5AA6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "250EE0BC-F79D-40D0-A185-8307F82DA8BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2902A37C-97AA-42CD-A038-3DA1A6E4653A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "102921DE-5513-4BCB-8383-D22A78C59735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC26BE5-265B-455A-83AE-E289A0C79B3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476FFA-DF47-4AAE-9570-A0A046162F53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "9861D27A-E515-40B7-99F9-4A318D77B7E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD207A4C-44F1-4847-B292-01C8C191B491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BDAD531-DE65-4F97-A499-AB22F1141BDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE49B821-1C36-4309-B51F-0CB8F79D2329",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43C4E8DF-2EE6-442C-A036-4F0FD04213FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4877F4FE-F705-4B09-B181-39E213B33050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "478FF90D-6A0B-49B9-BF3F-D45FFCFCDC65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F753B64D-DDB6-44AD-B087-9CDC7B266560",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC32F22-5477-4B52-82D7-7FE446447F19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5E97ECEF-8CC4-4B95-B5C7-3714E71DECBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5DC1A9-211D-46EE-A56C-B07C81F3344D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F22B52B8-008F-4C1D-9E34-4EF3A8FB8208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19C7593D-3DE3-42EB-AF48-39C709385EAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4598BBE7-5659-4B26-8E99-D3BA8BA51C08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CABFCBFB-7154-4652-843E-9996AB7AD0E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "05428F5A-C104-4A30-AB31-CDAD96471779",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4C05752E-D486-4387-AC6E-B94768DC688C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FD0889CB-4678-4A06-B77B-024E607CDE6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5735A80-B8BC-40C2-99BC-50B0685D844C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F1402A01-2B11-4448-AD52-CCA1BEF9CDAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C28D1BD3-E937-4BAC-B678-F292FEA51A5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D1424EFB-8794-4167-835A-F07E1841FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "39CBCA3C-1EDC-4791-A19C-E9EDB6D0BB1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "69ED27F7-69E2-4309-BF6D-E784E26D8555",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3ED071-E56F-42A7-9D38-70915950CEE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C512873E-6F9F-4173-B3BE-F295E2FD2F92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s del par\u00e1metro __dnnVariable hacia la URI por defecto."
}
],
"id": "CVE-2013-4649",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.677",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3943
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F2735AE-9598-42F5-B7CB-66C7502C397F",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4300BB9D-1A72-4005-AA68-35DB57A551E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "797726FF-24E9-415A-AC8B-2AE3301F8824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC6BB8DE-9497-42D7-A29D-BCAC75337A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "54AB8E47-5484-4449-88BA-90F0CCED285A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "B111556A-56AC-413C-A1B7-D973492BA8F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "FE94AE61-4CA4-48B5-BB08-D808CF750CFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C7863328-514C-4885-B5DD-5E04503962E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "750F735B-1419-4FCF-84F0-05E13608B73D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BF8EC31D-9C28-46D7-83C6-9720AA0DBC1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "81D4BDCE-EF83-48E2-BDC7-F6F6CE5CE51F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A5E7E9-4530-4CA9-BD61-4A22D17A898F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D7DEB2BD-8543-4408-B96E-616AFEBEEB12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "72A73BE5-6668-484E-8E7C-16E839E98882",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "31D0AA24-9FA3-4AFD-920A-295898473918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "34AF4B04-B86C-4BD0-94D9-3157AC55E542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB3D130-5DC4-4FE6-B178-EF1638E3A43D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68F28416-0ABF-4B2F-87A4-C4EC4D0CA227",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F1681BA4-9C05-45DF-B51B-D89633EB0C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "884BA1BF-BD03-4437-A02C-825B59634A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C627743E-9B8B-431B-A513-89CBF7C1E742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "677B54A1-6945-459F-9ADA-D6D9E89F2436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D101EF-4506-45D8-9717-5EE9A99B0A43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7059E6A-4A54-4364-8977-400C18905D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92A018EB-3C16-44BB-A872-E80D6F165395",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1285FF8E-EDB0-4C50-815B-DE40B1786601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "625C6564-F098-4C9B-AFE7-6686275A1016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6293D07D-4C07-4A5D-9532-455A7D5AA6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "250EE0BC-F79D-40D0-A185-8307F82DA8BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2902A37C-97AA-42CD-A038-3DA1A6E4653A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "102921DE-5513-4BCB-8383-D22A78C59735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC26BE5-265B-455A-83AE-E289A0C79B3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476FFA-DF47-4AAE-9570-A0A046162F53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "9861D27A-E515-40B7-99F9-4A318D77B7E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD207A4C-44F1-4847-B292-01C8C191B491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BDAD531-DE65-4F97-A499-AB22F1141BDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE49B821-1C36-4309-B51F-0CB8F79D2329",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43C4E8DF-2EE6-442C-A036-4F0FD04213FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4877F4FE-F705-4B09-B181-39E213B33050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "478FF90D-6A0B-49B9-BF3F-D45FFCFCDC65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F753B64D-DDB6-44AD-B087-9CDC7B266560",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC32F22-5477-4B52-82D7-7FE446447F19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5E97ECEF-8CC4-4B95-B5C7-3714E71DECBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5DC1A9-211D-46EE-A56C-B07C81F3344D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F22B52B8-008F-4C1D-9E34-4EF3A8FB8208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19C7593D-3DE3-42EB-AF48-39C709385EAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4598BBE7-5659-4B26-8E99-D3BA8BA51C08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CABFCBFB-7154-4652-843E-9996AB7AD0E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "05428F5A-C104-4A30-AB31-CDAD96471779",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4C05752E-D486-4387-AC6E-B94768DC688C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FD0889CB-4678-4A06-B77B-024E607CDE6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5735A80-B8BC-40C2-99BC-50B0685D844C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F1402A01-2B11-4448-AD52-CCA1BEF9CDAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C28D1BD3-E937-4BAC-B678-F292FEA51A5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D1424EFB-8794-4167-835A-F07E1841FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "39CBCA3C-1EDC-4791-A19C-E9EDB6D0BB1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "69ED27F7-69E2-4309-BF6D-E784E26D8555",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3ED071-E56F-42A7-9D38-70915950CEE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C512873E-6F9F-4173-B3BE-F295E2FD2F92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a trav\u00e9s de vectores relacionados con el campo Display Name en el Manage Profile."
}
],
"id": "CVE-2013-3943",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.647",
"references": [
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61809"
}
],
"sourceIdentifier": "PSIRT-CNA@flexerasoftware.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-7335
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F2735AE-9598-42F5-B7CB-66C7502C397F",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4300BB9D-1A72-4005-AA68-35DB57A551E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "797726FF-24E9-415A-AC8B-2AE3301F8824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC6BB8DE-9497-42D7-A29D-BCAC75337A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "54AB8E47-5484-4449-88BA-90F0CCED285A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "B111556A-56AC-413C-A1B7-D973492BA8F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "FE94AE61-4CA4-48B5-BB08-D808CF750CFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C7863328-514C-4885-B5DD-5E04503962E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "750F735B-1419-4FCF-84F0-05E13608B73D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BF8EC31D-9C28-46D7-83C6-9720AA0DBC1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "81D4BDCE-EF83-48E2-BDC7-F6F6CE5CE51F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A5E7E9-4530-4CA9-BD61-4A22D17A898F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D7DEB2BD-8543-4408-B96E-616AFEBEEB12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "72A73BE5-6668-484E-8E7C-16E839E98882",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "31D0AA24-9FA3-4AFD-920A-295898473918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "34AF4B04-B86C-4BD0-94D9-3157AC55E542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB3D130-5DC4-4FE6-B178-EF1638E3A43D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68F28416-0ABF-4B2F-87A4-C4EC4D0CA227",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F1681BA4-9C05-45DF-B51B-D89633EB0C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "884BA1BF-BD03-4437-A02C-825B59634A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C627743E-9B8B-431B-A513-89CBF7C1E742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "677B54A1-6945-459F-9ADA-D6D9E89F2436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D101EF-4506-45D8-9717-5EE9A99B0A43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7059E6A-4A54-4364-8977-400C18905D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92A018EB-3C16-44BB-A872-E80D6F165395",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1285FF8E-EDB0-4C50-815B-DE40B1786601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "625C6564-F098-4C9B-AFE7-6686275A1016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6293D07D-4C07-4A5D-9532-455A7D5AA6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "250EE0BC-F79D-40D0-A185-8307F82DA8BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2902A37C-97AA-42CD-A038-3DA1A6E4653A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "102921DE-5513-4BCB-8383-D22A78C59735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC26BE5-265B-455A-83AE-E289A0C79B3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476FFA-DF47-4AAE-9570-A0A046162F53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "9861D27A-E515-40B7-99F9-4A318D77B7E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD207A4C-44F1-4847-B292-01C8C191B491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BDAD531-DE65-4F97-A499-AB22F1141BDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE49B821-1C36-4309-B51F-0CB8F79D2329",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43C4E8DF-2EE6-442C-A036-4F0FD04213FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4877F4FE-F705-4B09-B181-39E213B33050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "478FF90D-6A0B-49B9-BF3F-D45FFCFCDC65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F753B64D-DDB6-44AD-B087-9CDC7B266560",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6BC32F22-5477-4B52-82D7-7FE446447F19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5E97ECEF-8CC4-4B95-B5C7-3714E71DECBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5DC1A9-211D-46EE-A56C-B07C81F3344D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F22B52B8-008F-4C1D-9E34-4EF3A8FB8208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19C7593D-3DE3-42EB-AF48-39C709385EAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4598BBE7-5659-4B26-8E99-D3BA8BA51C08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CABFCBFB-7154-4652-843E-9996AB7AD0E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "05428F5A-C104-4A30-AB31-CDAD96471779",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4C05752E-D486-4387-AC6E-B94768DC688C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FD0889CB-4678-4A06-B77B-024E607CDE6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5735A80-B8BC-40C2-99BC-50B0685D844C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F1402A01-2B11-4448-AD52-CCA1BEF9CDAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C28D1BD3-E937-4BAC-B678-F292FEA51A5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D1424EFB-8794-4167-835A-F07E1841FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "39CBCA3C-1EDC-4791-A19C-E9EDB6D0BB1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "69ED27F7-69E2-4309-BF6D-E784E26D8555",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3ED071-E56F-42A7-9D38-70915950CEE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C512873E-6F9F-4173-B3BE-F295E2FD2F92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de redirecci\u00f3n abierta en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-7335",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61809"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-1036
Vulnerability from fkie_nvd - Published: 2012-04-11 10:39 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | * | |
| dotnetnuke | dotnetnuke | 4.9.0 | |
| dotnetnuke | dotnetnuke | 4.9.1 | |
| dotnetnuke | dotnetnuke | 4.9.2 | |
| dotnetnuke | dotnetnuke | 4.9.3 | |
| dotnetnuke | dotnetnuke | 4.9.4 | |
| dotnetnuke | dotnetnuke | 4.9.5 | |
| dotnetnuke | dotnetnuke | 5.0.0 | |
| dotnetnuke | dotnetnuke | 5.0.1 | |
| dotnetnuke | dotnetnuke | 5.1.0 | |
| dotnetnuke | dotnetnuke | 5.1.1 | |
| dotnetnuke | dotnetnuke | 5.1.2 | |
| dotnetnuke | dotnetnuke | 5.1.3 | |
| dotnetnuke | dotnetnuke | 5.1.4 | |
| dotnetnuke | dotnetnuke | 5.2.0 | |
| dotnetnuke | dotnetnuke | 5.2.1 | |
| dotnetnuke | dotnetnuke | 5.2.2 | |
| dotnetnuke | dotnetnuke | 5.2.3 | |
| dotnetnuke | dotnetnuke | 5.3.0 | |
| dotnetnuke | dotnetnuke | 5.3.1 | |
| dotnetnuke | dotnetnuke | 5.4.0 | |
| dotnetnuke | dotnetnuke | 5.4.1 | |
| dotnetnuke | dotnetnuke | 5.4.2 | |
| dotnetnuke | dotnetnuke | 5.4.3 | |
| dotnetnuke | dotnetnuke | 5.4.4 | |
| dotnetnuke | dotnetnuke | 5.5.0 | |
| dotnetnuke | dotnetnuke | 5.5.1 | |
| dotnetnuke | dotnetnuke | 5.6.0 | |
| dotnetnuke | dotnetnuke | 5.6.1 | |
| dotnetnuke | dotnetnuke | 5.6.2 | |
| dotnetnuke | dotnetnuke | 6.0.0 | |
| dotnetnuke | dotnetnuke | 6.0.1 | |
| dotnetnuke | dotnetnuke | 6.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "869CAA52-4241-4049-A018-A2E3551AED90",
"versionEndIncluding": "5.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6EB0D105-8943-4DC8-A513-064B1ABC4A9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "39FED945-3341-4736-95C4-88CFE8B48E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9C52F9-E7B7-4EA2-84FD-C78A3EF17893",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4EFE03E3-0F41-4921-916F-56CDCCE77602",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A7C8162B-2426-48F5-A143-FA7425F961B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "40D39FE4-5D47-462B-B46E-19F6BE2F6197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DD98E0F-ABC7-43CF-B2C2-D0027D3D27B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E96050B6-DE09-49DF-8D6D-1F110AC609EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7E32FB03-B65E-4FD3-9595-ED8D19F2ABD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF953F4-BCAB-4FBA-AEA1-3846E0C19BCD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3CD34D98-57B1-4567-B22A-69BCDA96367B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E7DD606-ACEC-49F7-968B-93CE92DE0FAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3364254-4E9D-4218-BAA6-366A59B3D278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DC69C5AD-E642-4975-BF78-0A87A98C0033",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3CF511FB-9BF5-4282-BD46-E7B173B4C554",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "60DB93BB-9E8C-495C-B6F9-96DE89864A7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "25638D29-3B1C-4093-B85F-622EC84168D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "26FC5FB1-A6CA-4099-8068-6F01A3A15BB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E1DE6781-FF23-41F3-AC24-4574DB091970",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E03F432-AAEC-49FC-97FE-C816FCC3D8E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "805FB485-A468-442F-94B0-FFC51FBB8891",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B8FC888B-C2EE-459B-9E57-C11C79BDDDBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D38E404-2A46-4014-ABEB-DFAD5AB2EA95",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD207A4C-44F1-4847-B292-01C8C191B491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BDAD531-DE65-4F97-A499-AB22F1141BDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE49B821-1C36-4309-B51F-0CB8F79D2329",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el editor HTML telerik en DotNetNuke anteriores a v5.6.4 y v6.x anteriores a v6.1.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un mensaje."
}
],
"id": "CVE-2012-1036",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-04-11T10:39:26.387",
"references": [
{
"source": "cve@mitre.org",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-1030
Vulnerability from fkie_nvd - Published: 2012-04-11 10:39 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | 6.0.0 | |
| dotnetnuke | dotnetnuke | 6.0.1 | |
| dotnetnuke | dotnetnuke | 6.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AD207A4C-44F1-4847-B292-01C8C191B491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BDAD531-DE65-4F97-A499-AB22F1141BDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE49B821-1C36-4309-B51F-0CB8F79D2329",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en DotNetNuke v6.x hasta v6.0.2, permite a atacantes remotos asistidos por usuarios locales inyectar secuencias de comandos web o HTML a trav\u00e9s de una direcci\u00f3n URL que contenga texto que es usado en un mensaje emergente."
}
],
"id": "CVE-2012-1030",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-04-11T10:39:26.340",
"references": [
{
"source": "cve@mitre.org",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-4514
Vulnerability from fkie_nvd - Published: 2010-12-09 21:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | 5.05.01 | |
| dotnetnuke | dotnetnuke | 5.06.00 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476FFA-DF47-4AAE-9570-A0A046162F53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "9861D27A-E515-40B7-99F9-4A318D77B7E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Install/InstallWizard.aspx en DotNetNuke 5.05.01 y 5.06.00 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro __VIEWSTATE. NOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."
}
],
"id": "CVE-2010-4514",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-12-09T21:00:01.540",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42478"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/45180"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/45180"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securitytracker.com/id?1024828"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2009-4109
Vulnerability from fkie_nvd - Published: 2009-11-29 13:08 - Updated: 2025-04-09 00:30
Severity ?
Summary
The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | 4.0 | |
| dotnetnuke | dotnetnuke | 4.3.5 | |
| dotnetnuke | dotnetnuke | 4.4.1 | |
| dotnetnuke | dotnetnuke | 4.5.2 | |
| dotnetnuke | dotnetnuke | 4.5.4 | |
| dotnetnuke | dotnetnuke | 4.5.5 | |
| dotnetnuke | dotnetnuke | 4.6.0 | |
| dotnetnuke | dotnetnuke | 4.6.1 | |
| dotnetnuke | dotnetnuke | 4.6.2 | |
| dotnetnuke | dotnetnuke | 4.7.0 | |
| dotnetnuke | dotnetnuke | 4.8.0 | |
| dotnetnuke | dotnetnuke | 4.8.1 | |
| dotnetnuke | dotnetnuke | 4.8.2 | |
| dotnetnuke | dotnetnuke | 4.8.3 | |
| dotnetnuke | dotnetnuke | 4.8.4 | |
| dotnetnuke | dotnetnuke | 4.9 | |
| dotnetnuke | dotnetnuke | 4.9.1 | |
| dotnetnuke | dotnetnuke | 4.9.2 | |
| dotnetnuke | dotnetnuke | 5.0 | |
| dotnetnuke | dotnetnuke | 5.1 | |
| dotnetnuke | dotnetnuke | 5.1.1 | |
| dotnetnuke | dotnetnuke | 5.1.2 | |
| dotnetnuke | dotnetnuke | 5.1.3 | |
| dotnetnuke | dotnetnuke | 5.1.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "31D0AA24-9FA3-4AFD-920A-295898473918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "34AF4B04-B86C-4BD0-94D9-3157AC55E542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB3D130-5DC4-4FE6-B178-EF1638E3A43D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68F28416-0ABF-4B2F-87A4-C4EC4D0CA227",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F1681BA4-9C05-45DF-B51B-D89633EB0C70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "884BA1BF-BD03-4437-A02C-825B59634A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C627743E-9B8B-431B-A513-89CBF7C1E742",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "677B54A1-6945-459F-9ADA-D6D9E89F2436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D101EF-4506-45D8-9717-5EE9A99B0A43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7059E6A-4A54-4364-8977-400C18905D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92A018EB-3C16-44BB-A872-E80D6F165395",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1285FF8E-EDB0-4C50-815B-DE40B1786601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "625C6564-F098-4C9B-AFE7-6686275A1016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6293D07D-4C07-4A5D-9532-455A7D5AA6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "250EE0BC-F79D-40D0-A185-8307F82DA8BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2902A37C-97AA-42CD-A038-3DA1A6E4653A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "102921DE-5513-4BCB-8383-D22A78C59735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC26BE5-265B-455A-83AE-E289A0C79B3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information."
},
{
"lang": "es",
"value": "El asistente de instalaci\u00f3n en DotNetNuke v4.0 a la v5.1.4, no prev\u00e9 el acceso de usuarios an\u00f3nimos a la funcionalidad relacionada con la necesidad de una actualizaci\u00f3n, lo que permite a atacantes remotos acceder a la informaci\u00f3n de la versi\u00f3n de la aplicaci\u00f3n y posiblemente a otros datos."
}
],
"id": "CVE-2009-4109",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-11-29T13:08:29.610",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/60520"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/60520"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/37139"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2009-4110
Vulnerability from fkie_nvd - Published: 2009-11-29 13:08 - Updated: 2025-04-09 00:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dotnetnuke | dotnetnuke | 4.8.0 | |
| dotnetnuke | dotnetnuke | 4.8.1 | |
| dotnetnuke | dotnetnuke | 4.8.2 | |
| dotnetnuke | dotnetnuke | 4.8.3 | |
| dotnetnuke | dotnetnuke | 4.8.4 | |
| dotnetnuke | dotnetnuke | 4.9 | |
| dotnetnuke | dotnetnuke | 4.9.1 | |
| dotnetnuke | dotnetnuke | 4.9.2 | |
| dotnetnuke | dotnetnuke | 5.0 | |
| dotnetnuke | dotnetnuke | 5.1 | |
| dotnetnuke | dotnetnuke | 5.1.1 | |
| dotnetnuke | dotnetnuke | 5.1.2 | |
| dotnetnuke | dotnetnuke | 5.1.3 | |
| dotnetnuke | dotnetnuke | 5.1.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "92A018EB-3C16-44BB-A872-E80D6F165395",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1285FF8E-EDB0-4C50-815B-DE40B1786601",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "625C6564-F098-4C9B-AFE7-6686275A1016",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6293D07D-4C07-4A5D-9532-455A7D5AA6BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "250EE0BC-F79D-40D0-A185-8307F82DA8BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2902A37C-97AA-42CD-A038-3DA1A6E4653A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "403D90A9-C191-496A-BBB9-4915D39B675D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6B40DA1D-12CF-4DFF-9364-D60A53ED898D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "102921DE-5513-4BCB-8383-D22A78C59735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7DC26BE5-265B-455A-83AE-E289A0C79B3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFAD2896-6A9C-4953-8074-E689F359C900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "74B90994-F7F0-4BC9-99E4-E798B98899AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9A6FB531-44C1-4EA1-B69D-0D591673D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3A0857-2E5D-4BCD-AAE6-D50FCAE6FF67",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en la funcionalidad de b\u00fasqueda en DotNetNuke v4.8 a la v5.1.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del los campos de b\u00fasqueda que no est\u00e1n filtrados a adecuadamente antes de mostrarlos en la p\u00e1gina de resultados personalizados."
}
],
"id": "CVE-2009-4110",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-11-29T13:08:29.640",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/60519"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/60519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2015-2794 (GCVE-0-2015-2794)
Vulnerability from cvelistv5 – Published: 2017-02-06 15:00 – Updated: 2024-08-06 05:24
VLAI?
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:38.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "https://dotnetnuke.codeplex.com/releases/view/615317",
"refsource": "CONFIRM",
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"name": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2794",
"datePublished": "2017-02-06T15:00:00",
"dateReserved": "2015-03-30T00:00:00",
"dateUpdated": "2024-08-06T05:24:38.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7119 (GCVE-0-2016-7119)
Vulnerability from cvelistv5 – Published: 2016-08-31 14:00 – Updated: 2024-08-06 01:50
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7119",
"datePublished": "2016-08-31T14:00:00",
"dateReserved": "2016-08-31T00:00:00",
"dateUpdated": "2024-08-06T01:50:47.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-1566 (GCVE-0-2015-1566)
Vulnerability from cvelistv5 – Published: 2015-02-09 17:00 – Updated: 2024-09-16 20:51
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:47:16.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-02-09T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-1566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-1566",
"datePublished": "2015-02-09T17:00:00Z",
"dateReserved": "2015-02-09T00:00:00Z",
"dateUpdated": "2024-09-16T20:51:57.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7335 (GCVE-0-2013-7335)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-09-16 20:07
VLAI?
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T14:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7335",
"datePublished": "2014-03-12T14:00:00Z",
"dateReserved": "2014-03-12T00:00:00Z",
"dateUpdated": "2024-09-16T20:07:52.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4649 (GCVE-0-2013-4649)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:52
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:27.001Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4649",
"datePublished": "2014-03-12T14:00:00",
"dateReserved": "2013-06-24T00:00:00",
"dateUpdated": "2024-08-06T16:52:27.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3943 (GCVE-0-2013-3943)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:30
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T13:57:00",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2013-3943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2013-3943",
"datePublished": "2014-03-12T14:00:00",
"dateReserved": "2013-06-04T00:00:00",
"dateUpdated": "2024-08-06T16:30:49.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1036 (GCVE-0-2012-1036)
Vulnerability from cvelistv5 – Published: 2012-04-11 10:00 – Updated: 2024-09-16 17:34
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:26.763Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1036",
"datePublished": "2012-04-11T10:00:00Z",
"dateReserved": "2012-02-08T00:00:00Z",
"dateUpdated": "2024-09-16T17:34:31.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1030 (GCVE-0-2012-1030)
Vulnerability from cvelistv5 – Published: 2012-04-11 10:00 – Updated: 2024-09-16 20:47
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1030",
"datePublished": "2012-04-11T10:00:00Z",
"dateReserved": "2012-02-07T00:00:00Z",
"dateUpdated": "2024-09-16T20:47:55.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4514 (GCVE-0-2010-4514)
Vulnerability from cvelistv5 – Published: 2010-12-09 20:00 – Updated: 2024-09-17 04:09
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:17.357Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-09T20:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4514",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19",
"refsource": "MISC",
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45180"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4514",
"datePublished": "2010-12-09T20:00:00Z",
"dateReserved": "2010-12-09T00:00:00Z",
"dateUpdated": "2024-09-17T04:09:35.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-4110 (GCVE-0-2009-4110)
Vulnerability from cvelistv5 – Published: 2009-11-28 11:00 – Updated: 2024-08-07 06:54
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:09.545Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-11-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4110",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37480",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"refsource": "OSVDB",
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"name": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4110",
"datePublished": "2009-11-28T11:00:00",
"dateReserved": "2009-11-28T00:00:00",
"dateUpdated": "2024-08-07T06:54:09.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-2794 (GCVE-0-2015-2794)
Vulnerability from nvd – Published: 2017-02-06 15:00 – Updated: 2024-08-06 05:24
VLAI?
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:38.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "https://dotnetnuke.codeplex.com/releases/view/615317",
"refsource": "CONFIRM",
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"name": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2794",
"datePublished": "2017-02-06T15:00:00",
"dateReserved": "2015-03-30T00:00:00",
"dateUpdated": "2024-08-06T05:24:38.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7119 (GCVE-0-2016-7119)
Vulnerability from nvd – Published: 2016-08-31 14:00 – Updated: 2024-08-06 01:50
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7119",
"datePublished": "2016-08-31T14:00:00",
"dateReserved": "2016-08-31T00:00:00",
"dateUpdated": "2024-08-06T01:50:47.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-1566 (GCVE-0-2015-1566)
Vulnerability from nvd – Published: 2015-02-09 17:00 – Updated: 2024-09-16 20:51
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:47:16.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-02-09T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-1566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-1566",
"datePublished": "2015-02-09T17:00:00Z",
"dateReserved": "2015-02-09T00:00:00Z",
"dateUpdated": "2024-09-16T20:51:57.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7335 (GCVE-0-2013-7335)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-09-16 20:07
VLAI?
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T14:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7335",
"datePublished": "2014-03-12T14:00:00Z",
"dateReserved": "2014-03-12T00:00:00Z",
"dateUpdated": "2024-09-16T20:07:52.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4649 (GCVE-0-2013-4649)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:52
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:27.001Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4649",
"datePublished": "2014-03-12T14:00:00",
"dateReserved": "2013-06-24T00:00:00",
"dateUpdated": "2024-08-06T16:52:27.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3943 (GCVE-0-2013-3943)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:30
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T13:57:00",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2013-3943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2013-3943",
"datePublished": "2014-03-12T14:00:00",
"dateReserved": "2013-06-04T00:00:00",
"dateUpdated": "2024-08-06T16:30:49.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1036 (GCVE-0-2012-1036)
Vulnerability from nvd – Published: 2012-04-11 10:00 – Updated: 2024-09-16 17:34
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:26.763Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1036",
"datePublished": "2012-04-11T10:00:00Z",
"dateReserved": "2012-02-08T00:00:00Z",
"dateUpdated": "2024-09-16T17:34:31.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1030 (GCVE-0-2012-1030)
Vulnerability from nvd – Published: 2012-04-11 10:00 – Updated: 2024-09-16 20:47
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1030",
"datePublished": "2012-04-11T10:00:00Z",
"dateReserved": "2012-02-07T00:00:00Z",
"dateUpdated": "2024-09-16T20:47:55.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4514 (GCVE-0-2010-4514)
Vulnerability from nvd – Published: 2010-12-09 20:00 – Updated: 2024-09-17 04:09
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:17.357Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-09T20:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4514",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19",
"refsource": "MISC",
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45180"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4514",
"datePublished": "2010-12-09T20:00:00Z",
"dateReserved": "2010-12-09T00:00:00Z",
"dateUpdated": "2024-09-17T04:09:35.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}