Search criteria
84 vulnerabilities found for dotnetnuke by dotnetnuke
CVE-2015-2794 (GCVE-0-2015-2794)
Vulnerability from nvd – Published: 2017-02-06 15:00 – Updated: 2024-08-06 05:24
VLAI
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/community/security/sec… | x_refsource_CONFIRM |
| https://dotnetnuke.codeplex.com/releases/view/615317 | x_refsource_CONFIRM |
| https://www.exploit-db.com/exploits/39777/ | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/96373 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/community-blog/cid/155… | x_refsource_CONFIRM |
Date Public
2015-05-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:38.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "https://dotnetnuke.codeplex.com/releases/view/615317",
"refsource": "CONFIRM",
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"name": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2794",
"datePublished": "2017-02-06T15:00:00.000Z",
"dateReserved": "2015-03-30T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:24:38.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7119 (GCVE-0-2016-7119)
Vulnerability from nvd – Published: 2016-08-31 14:00 – Updated: 2024-08-06 01:50
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/community/security/sec… | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/92719 | vdb-entryx_refsource_BID |
Date Public
2016-03-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7119",
"datePublished": "2016-08-31T14:00:00.000Z",
"dateReserved": "2016-08-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-1566 (GCVE-0-2015-1566)
Vulnerability from nvd – Published: 2015-02-09 17:00 – Updated: 2024-09-16 20:51
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
| http://secunia.com/advisories/62832 | third-party-advisoryx_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:47:16.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-02-09T17:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-1566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-1566",
"datePublished": "2015-02-09T17:00:00.000Z",
"dateReserved": "2015-02-09T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:51:57.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7335 (GCVE-0-2013-7335)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-09-16 20:07
VLAI
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/61809 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T14:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7335",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2014-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:07:52.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4649 (GCVE-0-2013-4649)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:52
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://packetstormsecurity.com/files/122792/DotNe… | x_refsource_MISC |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2013-08-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:27.001Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4649",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2013-06-24T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:52:27.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3943 (GCVE-0-2013-3943)
Vulnerability from nvd – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:30
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/61809 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
Date Public
2013-08-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T13:57:00.000Z",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2013-3943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2013-3943",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2013-06-04T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:30:49.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1036 (GCVE-0-2012-1036)
Vulnerability from nvd – Published: 2012-04-11 10:00 – Updated: 2024-09-16 17:34
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://technet.microsoft.com/en-us/security/msvr/… | x_refsource_MISC |
| http://www.dotnetnuke.com/News/Security-Policy/Se… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:26.763Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1036",
"datePublished": "2012-04-11T10:00:00.000Z",
"dateReserved": "2012-02-08T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:34:31.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1030 (GCVE-0-2012-1030)
Vulnerability from nvd – Published: 2012-04-11 10:00 – Updated: 2024-09-16 20:47
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dotnetnuke.com/News/Security-Policy/Se… | x_refsource_CONFIRM |
| http://technet.microsoft.com/en-us/security/msvr/… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1030",
"datePublished": "2012-04-11T10:00:00.000Z",
"dateReserved": "2012-02-07T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:47:55.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4514 (GCVE-0-2010-4514)
Vulnerability from nvd – Published: 2010-12-09 20:00 – Updated: 2024-09-17 04:09
VLAI
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.org/files/view/96378/P… | x_refsource_MISC |
| http://www.procheckup.com/vulnerability_manager/v… | x_refsource_MISC |
| http://www.securitytracker.com/id?1024828 | vdb-entryx_refsource_SECTRACK |
| http://secunia.com/advisories/42478 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/45180 | vdb-entryx_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:17.357Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-09T20:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4514",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19",
"refsource": "MISC",
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45180"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4514",
"datePublished": "2010-12-09T20:00:00.000Z",
"dateReserved": "2010-12-09T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:09:35.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-4110 (GCVE-0-2009-4110)
Vulnerability from nvd – Published: 2009-11-28 11:00 – Updated: 2024-08-07 06:54
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/37480 | third-party-advisoryx_refsource_SECUNIA |
| http://osvdb.org/60519 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/bid/37139 | vdb-entryx_refsource_BID |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.dotnetnuke.com/News/SecurityPolicy/sec… | x_refsource_CONFIRM |
Date Public
2009-11-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:09.545Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-11-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4110",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37480",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37480"
},
{
"name": "60519",
"refsource": "OSVDB",
"url": "http://osvdb.org/60519"
},
{
"name": "37139",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "dotnetnuke-search-xss(54453)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"name": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4110",
"datePublished": "2009-11-28T11:00:00.000Z",
"dateReserved": "2009-11-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T06:54:09.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-4109 (GCVE-0-2009-4109)
Vulnerability from nvd – Published: 2009-11-28 11:00 – Updated: 2024-09-16 17:49
VLAI
Summary
The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/37480 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/37139 | vdb-entryx_refsource_BID |
| http://www.dotnetnuke.com/News/SecurityPolicy/sec… | x_refsource_CONFIRM |
| http://osvdb.org/60520 | vdb-entryx_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:10.136Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx"
},
{
"name": "60520",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/60520"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-11-28T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37480",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37480"
},
{
"name": "37139",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37139"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx"
},
{
"name": "60520",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/60520"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4109",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37480",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37480"
},
{
"name": "37139",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"name": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx"
},
{
"name": "60520",
"refsource": "OSVDB",
"url": "http://osvdb.org/60520"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4109",
"datePublished": "2009-11-28T11:00:00.000Z",
"dateReserved": "2009-11-28T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:49:15.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
FKIE_CVE-2015-2794
Vulnerability from fkie_nvd - Published: 2017-02-06 15:59 - Updated: 2026-05-13 00:24
Severity
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8E39BB11-55FD-439B-9006-7BE20A8A55C1",
"versionEndIncluding": "07.04.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
},
{
"lang": "es",
"value": "El asistente de instalaci\u00f3n en DotNetNuke (DNN) en versiones anteriores a 7.4.1 permite a atacantes remotos reinstalar la aplicaci\u00f3n y obtener acceso SuperUser a trav\u00e9s de una solicitud directa a Install/InstallWizard.aspx."
}
],
"id": "CVE-2015-2794",
"lastModified": "2026-05-13T00:24:29.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-06T15:59:00.137",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/39777/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2016-7119
Vulnerability from fkie_nvd - Published: 2016-08-31 14:59 - Updated: 2026-05-06 22:30
Severity
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCF7E797-9516-4D93-9DD8-83AF417C7193",
"versionEndIncluding": "08.00.04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la secci\u00f3n de biograf\u00eda del perfil del usuario en DotNetNuke (DNN) en versiones anteriores a 8.0.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un atributo onclick manipulado en un elemento IMG."
}
],
"id": "CVE-2016-7119",
"lastModified": "2026-05-06T22:30:45.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T14:59:01.190",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92719"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92719"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2015-1566
Vulnerability from fkie_nvd - Published: 2015-02-09 17:59 - Updated: 2026-05-06 22:30
Severity
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "83A6DAB1-2CB2-48DC-A5DF-19F3C9BD963F",
"versionEndIncluding": "07.03.04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 7.4.0 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2015-1566",
"lastModified": "2026-05-06T22:30:45.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-02-09T17:59:10.687",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/62832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/62832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-4649
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2026-05-06 22:30
Severity
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7172E61-F921-412E-B882-9318B02AA36A",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2548573E-7FDD-425D-95B6-ADCEAA77F722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2577EF82-53B4-4214-89EA-A292DE87F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C1E536AA-D810-4D2D-BF58-A1CDB37D9B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9E04BBB1-E7C2-44E5-AAD7-405EC5CEE5C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "DF31E99C-DD44-4016-82C2-9F52D54C691F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "2ED5EEC4-20B7-40A8-AF4F-34A3520F5011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C0DE6E92-32F1-4388-89A3-386D6054A274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B1310A0F-89BC-4199-9588-A676A65B8985",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A385977D-BE60-4EA3-B416-D2D33B1616CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A63CE487-4186-4264-9E65-39B3F4ABC3FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC3E38B-1C6A-406B-96BF-3BE49094DF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B169A9F8-CEB6-4F99-B0BE-A25BEF964208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B056AAD8-8E66-498D-ABC1-A582691BDB03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F2824231-B0CD-46A2-967E-93691A53F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1EB40A1C-6104-41C0-8CE7-65097AA1E756",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B50DFDAD-2624-45F3-ACA2-176197F71F95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "225B1E93-6963-4569-AF6F-E534E4DC351E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "84703D9D-6318-4F78-91FA-015B9484A8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6D578455-9973-4BC4-BA10-2A4AB0301840",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E404EC72-E317-4D5A-B13E-31D6C569F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD79C8EA-CD84-47AD-93DC-152EB717DC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6AB4573D-5B8E-41D2-986A-338D1F03CB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC55855-1B13-43F5-91C5-D56F1D605F40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7163CF0E-F277-4CB8-8CB7-5701200C9B48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "067321EB-5A1D-43B6-9826-6E14701CFFCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A561AD7-1E12-4F43-B78E-38B565B41B1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AE07817D-D3D9-4A9F-90A5-CFE0F2CC4F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8D12406C-E93F-4248-B8EC-C34DA36B3C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F222B3C7-E840-46CF-8229-8E31307B5769",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F4D4D42-C5DD-44EF-9F73-6B99CA40F3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18DA3FA5-DD2E-4B46-8EA7-CDD6A0863CBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F76D4AA2-E767-4912-B832-584E369787E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "C8818FD6-AF8D-49DB-B6A4-CCD1C8336FA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85A82946-6428-458D-A236-A7EE25BD429E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "319E5E72-14C1-471E-A869-F8CB293F593B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6DA723A1-14F6-4DE7-B1F0-0CF141FA4EE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D6972396-EF87-4086-9955-29D59CBFF8BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "240DBD03-D23D-4676-BF26-D89A9FD6E56C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A40CDA73-445C-45EC-902B-43E3730A25E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42C53AA9-BD9F-4109-B1C5-4D21A9B3E691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "81DCC46F-F5A5-47B8-8876-2724D28DB3D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "08245C06-ADA5-48AD-933B-44DC20D4C2C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "323DD962-E80D-4B08-B86B-E0B40EBE72B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "28AB98EC-F92B-4379-A51E-B79634FFB7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB18908E-A63B-497C-B08C-D5C28624C7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E75C1A82-CB17-4F63-92FB-189E72939EDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6D7318BD-6BFA-44AD-A59A-4E1D64CB7781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7AA945B1-609C-4BDD-BBA7-C4E56483F0AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3DA74EA-ADDD-46D5-970D-8206817461EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "859D8330-F3C6-4A29-9BB9-2377400BB04B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD27C66E-ED83-4A07-AAB9-D60976E99A67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3BDF5522-056B-4F60-AF80-24894A6B5F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9729CC9C-582C-43A4-A66A-CA0C0802955E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A768F949-A9CA-41EC-B163-F0A8911A4D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C92D9F8-4C93-4950-B77B-5DBCE96909A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s del par\u00e1metro __dnnVariable hacia la URI por defecto."
}
],
"id": "CVE-2013-4649",
"lastModified": "2026-05-06T22:30:45.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.677",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-7335
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2026-05-06 22:30
Severity
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7172E61-F921-412E-B882-9318B02AA36A",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2548573E-7FDD-425D-95B6-ADCEAA77F722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2577EF82-53B4-4214-89EA-A292DE87F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C1E536AA-D810-4D2D-BF58-A1CDB37D9B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9E04BBB1-E7C2-44E5-AAD7-405EC5CEE5C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "DF31E99C-DD44-4016-82C2-9F52D54C691F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "2ED5EEC4-20B7-40A8-AF4F-34A3520F5011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C0DE6E92-32F1-4388-89A3-386D6054A274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B1310A0F-89BC-4199-9588-A676A65B8985",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A385977D-BE60-4EA3-B416-D2D33B1616CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A63CE487-4186-4264-9E65-39B3F4ABC3FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC3E38B-1C6A-406B-96BF-3BE49094DF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B169A9F8-CEB6-4F99-B0BE-A25BEF964208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B056AAD8-8E66-498D-ABC1-A582691BDB03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F2824231-B0CD-46A2-967E-93691A53F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1EB40A1C-6104-41C0-8CE7-65097AA1E756",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B50DFDAD-2624-45F3-ACA2-176197F71F95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "225B1E93-6963-4569-AF6F-E534E4DC351E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "84703D9D-6318-4F78-91FA-015B9484A8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6D578455-9973-4BC4-BA10-2A4AB0301840",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E404EC72-E317-4D5A-B13E-31D6C569F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD79C8EA-CD84-47AD-93DC-152EB717DC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6AB4573D-5B8E-41D2-986A-338D1F03CB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC55855-1B13-43F5-91C5-D56F1D605F40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7163CF0E-F277-4CB8-8CB7-5701200C9B48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "067321EB-5A1D-43B6-9826-6E14701CFFCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A561AD7-1E12-4F43-B78E-38B565B41B1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AE07817D-D3D9-4A9F-90A5-CFE0F2CC4F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8D12406C-E93F-4248-B8EC-C34DA36B3C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F222B3C7-E840-46CF-8229-8E31307B5769",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F4D4D42-C5DD-44EF-9F73-6B99CA40F3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18DA3FA5-DD2E-4B46-8EA7-CDD6A0863CBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F76D4AA2-E767-4912-B832-584E369787E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "C8818FD6-AF8D-49DB-B6A4-CCD1C8336FA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85A82946-6428-458D-A236-A7EE25BD429E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "319E5E72-14C1-471E-A869-F8CB293F593B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6DA723A1-14F6-4DE7-B1F0-0CF141FA4EE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D6972396-EF87-4086-9955-29D59CBFF8BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "240DBD03-D23D-4676-BF26-D89A9FD6E56C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A40CDA73-445C-45EC-902B-43E3730A25E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42C53AA9-BD9F-4109-B1C5-4D21A9B3E691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "81DCC46F-F5A5-47B8-8876-2724D28DB3D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "08245C06-ADA5-48AD-933B-44DC20D4C2C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "323DD962-E80D-4B08-B86B-E0B40EBE72B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "28AB98EC-F92B-4379-A51E-B79634FFB7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB18908E-A63B-497C-B08C-D5C28624C7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E75C1A82-CB17-4F63-92FB-189E72939EDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6D7318BD-6BFA-44AD-A59A-4E1D64CB7781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7AA945B1-609C-4BDD-BBA7-C4E56483F0AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3DA74EA-ADDD-46D5-970D-8206817461EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "859D8330-F3C6-4A29-9BB9-2377400BB04B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD27C66E-ED83-4A07-AAB9-D60976E99A67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3BDF5522-056B-4F60-AF80-24894A6B5F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9729CC9C-582C-43A4-A66A-CA0C0802955E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A768F949-A9CA-41EC-B163-F0A8911A4D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C92D9F8-4C93-4950-B77B-5DBCE96909A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de redirecci\u00f3n abierta en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-7335",
"lastModified": "2026-05-06T22:30:45.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61809"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2013-3943
Vulnerability from fkie_nvd - Published: 2014-03-12 14:55 - Updated: 2026-05-06 22:30
Severity
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7172E61-F921-412E-B882-9318B02AA36A",
"versionEndIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2548573E-7FDD-425D-95B6-ADCEAA77F722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2577EF82-53B4-4214-89EA-A292DE87F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C1E536AA-D810-4D2D-BF58-A1CDB37D9B1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9E04BBB1-E7C2-44E5-AAD7-405EC5CEE5C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10d:*:*:*:*:*:*:*",
"matchCriteriaId": "DF31E99C-DD44-4016-82C2-9F52D54C691F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:1.0.10e:*:*:*:*:*:*:*",
"matchCriteriaId": "2ED5EEC4-20B7-40A8-AF4F-34A3520F5011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C0DE6E92-32F1-4388-89A3-386D6054A274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B1310A0F-89BC-4199-9588-A676A65B8985",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A385977D-BE60-4EA3-B416-D2D33B1616CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A63CE487-4186-4264-9E65-39B3F4ABC3FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC3E38B-1C6A-406B-96BF-3BE49094DF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B169A9F8-CEB6-4F99-B0BE-A25BEF964208",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:3.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B056AAD8-8E66-498D-ABC1-A582691BDB03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F2824231-B0CD-46A2-967E-93691A53F30B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1EB40A1C-6104-41C0-8CE7-65097AA1E756",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B50DFDAD-2624-45F3-ACA2-176197F71F95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "225B1E93-6963-4569-AF6F-E534E4DC351E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "84703D9D-6318-4F78-91FA-015B9484A8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6D578455-9973-4BC4-BA10-2A4AB0301840",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E404EC72-E317-4D5A-B13E-31D6C569F4D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD79C8EA-CD84-47AD-93DC-152EB717DC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6AB4573D-5B8E-41D2-986A-338D1F03CB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AAC55855-1B13-43F5-91C5-D56F1D605F40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7163CF0E-F277-4CB8-8CB7-5701200C9B48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "067321EB-5A1D-43B6-9826-6E14701CFFCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A561AD7-1E12-4F43-B78E-38B565B41B1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AE07817D-D3D9-4A9F-90A5-CFE0F2CC4F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8D12406C-E93F-4248-B8EC-C34DA36B3C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F222B3C7-E840-46CF-8229-8E31307B5769",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F4D4D42-C5DD-44EF-9F73-6B99CA40F3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18DA3FA5-DD2E-4B46-8EA7-CDD6A0863CBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F76D4AA2-E767-4912-B832-584E369787E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "C8818FD6-AF8D-49DB-B6A4-CCD1C8336FA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85A82946-6428-458D-A236-A7EE25BD429E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "319E5E72-14C1-471E-A869-F8CB293F593B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6DA723A1-14F6-4DE7-B1F0-0CF141FA4EE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D6972396-EF87-4086-9955-29D59CBFF8BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "240DBD03-D23D-4676-BF26-D89A9FD6E56C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A40CDA73-445C-45EC-902B-43E3730A25E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "42C53AA9-BD9F-4109-B1C5-4D21A9B3E691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "81DCC46F-F5A5-47B8-8876-2724D28DB3D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "08245C06-ADA5-48AD-933B-44DC20D4C2C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "323DD962-E80D-4B08-B86B-E0B40EBE72B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "28AB98EC-F92B-4379-A51E-B79634FFB7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CB18908E-A63B-497C-B08C-D5C28624C7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E75C1A82-CB17-4F63-92FB-189E72939EDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6D7318BD-6BFA-44AD-A59A-4E1D64CB7781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7AA945B1-609C-4BDD-BBA7-C4E56483F0AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3DA74EA-ADDD-46D5-970D-8206817461EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "859D8330-F3C6-4A29-9BB9-2377400BB04B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD27C66E-ED83-4A07-AAB9-D60976E99A67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3BDF5522-056B-4F60-AF80-24894A6B5F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9729CC9C-582C-43A4-A66A-CA0C0802955E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A768F949-A9CA-41EC-B163-F0A8911A4D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:7.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C92D9F8-4C93-4950-B77B-5DBCE96909A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en DotNetNuke (DNN) anterior a 6.2.9 y 7.x anterior a 7.1.1 permite a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a trav\u00e9s de vectores relacionados con el campo Display Name en el Manage Profile."
}
],
"id": "CVE-2013-3943",
"lastModified": "2026-05-06T22:30:45.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-12T14:55:30.647",
"references": [
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "PSIRT-CNA@flexerasoftware.com",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61809"
}
],
"sourceIdentifier": "PSIRT-CNA@flexerasoftware.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-1036
Vulnerability from fkie_nvd - Published: 2012-04-11 10:39 - Updated: 2026-04-29 01:13
Severity
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | * | |
| dnnsoftware | dotnetnuke | 4.9.1 | |
| dnnsoftware | dotnetnuke | 4.9.2 | |
| dnnsoftware | dotnetnuke | 5.1.1 | |
| dnnsoftware | dotnetnuke | 5.1.2 | |
| dnnsoftware | dotnetnuke | 5.1.3 | |
| dnnsoftware | dotnetnuke | 5.1.4 | |
| dotnetnuke | dotnetnuke | 4.9.0 | |
| dotnetnuke | dotnetnuke | 4.9.3 | |
| dotnetnuke | dotnetnuke | 4.9.4 | |
| dotnetnuke | dotnetnuke | 4.9.5 | |
| dotnetnuke | dotnetnuke | 5.0.0 | |
| dotnetnuke | dotnetnuke | 5.0.1 | |
| dotnetnuke | dotnetnuke | 5.1.0 | |
| dotnetnuke | dotnetnuke | 5.2.0 | |
| dotnetnuke | dotnetnuke | 5.2.1 | |
| dotnetnuke | dotnetnuke | 5.2.2 | |
| dotnetnuke | dotnetnuke | 5.2.3 | |
| dotnetnuke | dotnetnuke | 5.3.0 | |
| dotnetnuke | dotnetnuke | 5.3.1 | |
| dotnetnuke | dotnetnuke | 5.4.0 | |
| dotnetnuke | dotnetnuke | 5.4.1 | |
| dotnetnuke | dotnetnuke | 5.4.2 | |
| dotnetnuke | dotnetnuke | 5.4.3 | |
| dotnetnuke | dotnetnuke | 5.4.4 | |
| dotnetnuke | dotnetnuke | 5.5.0 | |
| dotnetnuke | dotnetnuke | 5.5.1 | |
| dotnetnuke | dotnetnuke | 5.6.0 | |
| dotnetnuke | dotnetnuke | 5.6.1 | |
| dotnetnuke | dotnetnuke | 5.6.2 | |
| dnnsoftware | dotnetnuke | 6.0.0 | |
| dnnsoftware | dotnetnuke | 6.0.1 | |
| dnnsoftware | dotnetnuke | 6.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55C8F73C-26DC-4A1A-AAFB-64203E90CA94",
"versionEndIncluding": "5.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6EB0D105-8943-4DC8-A513-064B1ABC4A9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "39FED945-3341-4736-95C4-88CFE8B48E83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9C52F9-E7B7-4EA2-84FD-C78A3EF17893",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:4.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4EFE03E3-0F41-4921-916F-56CDCCE77602",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A7C8162B-2426-48F5-A143-FA7425F961B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "40D39FE4-5D47-462B-B46E-19F6BE2F6197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DD98E0F-ABC7-43CF-B2C2-D0027D3D27B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E96050B6-DE09-49DF-8D6D-1F110AC609EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7E32FB03-B65E-4FD3-9595-ED8D19F2ABD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF953F4-BCAB-4FBA-AEA1-3846E0C19BCD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3CD34D98-57B1-4567-B22A-69BCDA96367B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E7DD606-ACEC-49F7-968B-93CE92DE0FAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3364254-4E9D-4218-BAA6-366A59B3D278",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DC69C5AD-E642-4975-BF78-0A87A98C0033",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3CF511FB-9BF5-4282-BD46-E7B173B4C554",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "60DB93BB-9E8C-495C-B6F9-96DE89864A7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "25638D29-3B1C-4093-B85F-622EC84168D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "26FC5FB1-A6CA-4099-8068-6F01A3A15BB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E1DE6781-FF23-41F3-AC24-4574DB091970",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E03F432-AAEC-49FC-97FE-C816FCC3D8E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "805FB485-A468-442F-94B0-FFC51FBB8891",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B8FC888B-C2EE-459B-9E57-C11C79BDDDBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dotnetnuke:dotnetnuke:5.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2D38E404-2A46-4014-ABEB-DFAD5AB2EA95",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el editor HTML telerik en DotNetNuke anteriores a v5.6.4 y v6.x anteriores a v6.1.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un mensaje."
}
],
"id": "CVE-2012-1036",
"lastModified": "2026-04-29T01:13:23.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-04-11T10:39:26.387",
"references": [
{
"source": "cve@mitre.org",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2012-1030
Vulnerability from fkie_nvd - Published: 2012-04-11 10:39 - Updated: 2026-04-29 01:13
Severity
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | 6.0.0 | |
| dnnsoftware | dotnetnuke | 6.0.1 | |
| dnnsoftware | dotnetnuke | 6.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D1998F15-AE98-4C16-8036-EFFCF009A9F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1E488A0B-F58B-435B-A325-A4BCD8937DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:6.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5691D94-22C8-46FA-A91E-0EFA6E75E204",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
},
{
"lang": "es",
"value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en DotNetNuke v6.x hasta v6.0.2, permite a atacantes remotos asistidos por usuarios locales inyectar secuencias de comandos web o HTML a trav\u00e9s de una direcci\u00f3n URL que contenga texto que es usado en un mensaje emergente."
}
],
"id": "CVE-2012-1030",
"lastModified": "2026-04-29T01:13:23.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-04-11T10:39:26.340",
"references": [
{
"source": "cve@mitre.org",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-4514
Vulnerability from fkie_nvd - Published: 2010-12-09 21:00 - Updated: 2026-04-29 01:13
Severity
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | 5.05.01 | |
| dnnsoftware | dotnetnuke | 5.06.00 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.05.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F76D4AA2-E767-4912-B832-584E369787E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.06.00:*:*:*:*:*:*:*",
"matchCriteriaId": "C8818FD6-AF8D-49DB-B6A4-CCD1C8336FA7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Install/InstallWizard.aspx en DotNetNuke 5.05.01 y 5.06.00 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro __VIEWSTATE. NOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."
}
],
"id": "CVE-2010-4514",
"lastModified": "2026-04-29T01:13:23.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-12-09T21:00:01.540",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42478"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/45180"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/45180"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securitytracker.com/id?1024828"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2009-4110
Vulnerability from fkie_nvd - Published: 2009-11-29 13:08 - Updated: 2026-04-24 17:34
Severity
Summary
Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| dnnsoftware | dotnetnuke | 4.8.0 | |
| dnnsoftware | dotnetnuke | 4.8.1 | |
| dnnsoftware | dotnetnuke | 4.8.2 | |
| dnnsoftware | dotnetnuke | 4.8.3 | |
| dnnsoftware | dotnetnuke | 4.8.4 | |
| dnnsoftware | dotnetnuke | 4.9 | |
| dnnsoftware | dotnetnuke | 4.9.1 | |
| dnnsoftware | dotnetnuke | 4.9.2 | |
| dnnsoftware | dotnetnuke | 5.0 | |
| dnnsoftware | dotnetnuke | 5.1 | |
| dnnsoftware | dotnetnuke | 5.1.1 | |
| dnnsoftware | dotnetnuke | 5.1.2 | |
| dnnsoftware | dotnetnuke | 5.1.3 | |
| dnnsoftware | dotnetnuke | 5.1.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7163CF0E-F277-4CB8-8CB7-5701200C9B48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "067321EB-5A1D-43B6-9826-6E14701CFFCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A561AD7-1E12-4F43-B78E-38B565B41B1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AE07817D-D3D9-4A9F-90A5-CFE0F2CC4F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8D12406C-E93F-4248-B8EC-C34DA36B3C6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F222B3C7-E840-46CF-8229-8E31307B5769",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C9852A91-F153-49CB-B376-657CBC4593A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:4.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEFF613-B1B3-4799-9D40-E3A092219F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F4D4D42-C5DD-44EF-9F73-6B99CA40F3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "18DA3FA5-DD2E-4B46-8EA7-CDD6A0863CBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8B6E998E-A32E-4FA5-BAA5-8B4CFB8E53B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "485DFABC-32FF-4160-8D5D-291473F71E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C992BEB6-17C5-4FEE-A75A-3425A8614FC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:5.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D9942AEF-A71A-4CA3-898D-CC1DE326593E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en la funcionalidad de b\u00fasqueda en DotNetNuke v4.8 a la v5.1.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del los campos de b\u00fasqueda que no est\u00e1n filtrados a adecuadamente antes de mostrarlos en la p\u00e1gina de resultados personalizados."
}
],
"id": "CVE-2009-4110",
"lastModified": "2026-04-24T17:34:37.240",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-11-29T13:08:29.640",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/60519"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/60519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37480"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/37139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54453"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2015-2794 (GCVE-0-2015-2794)
Vulnerability from cvelistv5 – Published: 2017-02-06 15:00 – Updated: 2024-08-06 05:24
VLAI
Summary
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/community/security/sec… | x_refsource_CONFIRM |
| https://dotnetnuke.codeplex.com/releases/view/615317 | x_refsource_CONFIRM |
| https://www.exploit-db.com/exploits/39777/ | exploitx_refsource_EXPLOIT-DB |
| http://www.securityfocus.com/bid/96373 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/community-blog/cid/155… | x_refsource_CONFIRM |
Date Public
2015-05-26 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:24:38.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-01T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96373"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2794",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "https://dotnetnuke.codeplex.com/releases/view/615317",
"refsource": "CONFIRM",
"url": "https://dotnetnuke.codeplex.com/releases/view/615317"
},
{
"name": "39777",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39777/"
},
{
"name": "96373",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96373"
},
{
"name": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2794",
"datePublished": "2017-02-06T15:00:00.000Z",
"dateReserved": "2015-03-30T00:00:00.000Z",
"dateUpdated": "2024-08-06T05:24:38.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7119 (GCVE-0-2016-7119)
Vulnerability from cvelistv5 – Published: 2016-08-31 14:00 – Updated: 2024-08-06 01:50
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/community/security/sec… | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/92719 | vdb-entryx_refsource_BID |
Date Public
2016-03-01 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T19:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92719"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/community/security/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/community/security/security-center"
},
{
"name": "92719",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92719"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7119",
"datePublished": "2016-08-31T14:00:00.000Z",
"dateReserved": "2016-08-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-1566 (GCVE-0-2015-1566)
Vulnerability from cvelistv5 – Published: 2015-02-09 17:00 – Updated: 2024-09-16 20:51
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
| http://secunia.com/advisories/62832 | third-party-advisoryx_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T04:47:16.918Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-02-09T17:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-1566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "62832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-1566",
"datePublished": "2015-02-09T17:00:00.000Z",
"dateReserved": "2015-02-09T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:51:57.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3943 (GCVE-0-2013-3943)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:30
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/61809 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
Date Public
2013-08-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:49.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T13:57:00.000Z",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2013-3943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2013-3943",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2013-06-04T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:30:49.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7335 (GCVE-0-2013-7335)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-09-16 20:07
VLAI
Summary
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/61809 | vdb-entryx_refsource_BID |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:20.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-12T14:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "61809",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61809"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7335",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2014-03-12T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:07:52.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4649 (GCVE-0-2013-4649)
Vulnerability from cvelistv5 – Published: 2014-03-12 14:00 – Updated: 2024-08-06 16:52
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/53493 | third-party-advisoryx_refsource_SECUNIA |
| http://packetstormsecurity.com/files/122792/DotNe… | x_refsource_MISC |
| http://www.dnnsoftware.com/platform/manage/securi… | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2013-08-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:27.001Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53493",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53493"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4649",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53493",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53493"
},
{
"name": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html"
},
{
"name": "http://www.dnnsoftware.com/platform/manage/security-center",
"refsource": "CONFIRM",
"url": "http://www.dnnsoftware.com/platform/manage/security-center"
},
{
"name": "dotnetnuke-cve20134649-dnnvariable-xss(86432)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86432"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4649",
"datePublished": "2014-03-12T14:00:00.000Z",
"dateReserved": "2013-06-24T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:52:27.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1030 (GCVE-0-2012-1030)
Vulnerability from cvelistv5 – Published: 2012-04-11 10:00 – Updated: 2024-09-16 20:47
VLAI
Summary
Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.dotnetnuke.com/News/Security-Policy/Se… | x_refsource_CONFIRM |
| http://technet.microsoft.com/en-us/security/msvr/… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.237Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx"
},
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-003"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1030",
"datePublished": "2012-04-11T10:00:00.000Z",
"dateReserved": "2012-02-07T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:47:55.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1036 (GCVE-0-2012-1036)
Vulnerability from cvelistv5 – Published: 2012-04-11 10:00 – Updated: 2024-09-16 17:34
VLAI
Summary
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://technet.microsoft.com/en-us/security/msvr/… | x_refsource_MISC |
| http://www.dotnetnuke.com/News/Security-Policy/Se… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:26.763Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-04-11T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002",
"refsource": "MISC",
"url": "http://technet.microsoft.com/en-us/security/msvr/msvr12-002"
},
{
"name": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx",
"refsource": "CONFIRM",
"url": "http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1036",
"datePublished": "2012-04-11T10:00:00.000Z",
"dateReserved": "2012-02-08T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:34:31.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-4514 (GCVE-0-2010-4514)
Vulnerability from cvelistv5 – Published: 2010-12-09 20:00 – Updated: 2024-09-17 04:09
VLAI
Summary
Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.org/files/view/96378/P… | x_refsource_MISC |
| http://www.procheckup.com/vulnerability_manager/v… | x_refsource_MISC |
| http://www.securitytracker.com/id?1024828 | vdb-entryx_refsource_SECTRACK |
| http://secunia.com/advisories/42478 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/45180 | vdb-entryx_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:17.357Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-09T20:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45180"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4514",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the __VIEWSTATE parameter. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/view/96378/PR10-19.txt"
},
{
"name": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19",
"refsource": "MISC",
"url": "http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-19"
},
{
"name": "1024828",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1024828"
},
{
"name": "42478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42478"
},
{
"name": "45180",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45180"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4514",
"datePublished": "2010-12-09T20:00:00.000Z",
"dateReserved": "2010-12-09T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:09:35.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}