DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script or HTML.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | * |
Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 1.0.10e |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
| dotnetnuke | dotnetnuke | 3.0.7 |
| dotnetnuke | dotnetnuke | 4.0 |
| dotnetnuke | dotnetnuke | 2.1.2 |
| dotnetnuke | dotnetnuke | 3.1.0 |
| dotnetnuke | dotnetnuke | 3.0.8 |
| dotnetnuke | dotnetnuke | 2.1.1 |
Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dnnsoftware | dotnetnuke | 5.1.3 |
| dotnetnuke | dotnetnuke | 4.9.4 |
| dotnetnuke | dotnetnuke | 5.0.1 |
| dotnetnuke | dotnetnuke | 5.2.2 |
| dotnetnuke | dotnetnuke | 5.2.0 |
| dotnetnuke | dotnetnuke | 5.4.0 |
| dnnsoftware | dotnetnuke | 6.0.1 |
| dnnsoftware | dotnetnuke | * |
| dnnsoftware | dotnetnuke | 6.0.0 |
| dotnetnuke | dotnetnuke | 5.3.0 |
| dotnetnuke | dotnetnuke | 5.6.2 |
| dnnsoftware | dotnetnuke | 5.1.4 |
| dotnetnuke | dotnetnuke | 4.9.5 |
| dotnetnuke | dotnetnuke | 5.4.2 |
| dotnetnuke | dotnetnuke | 5.6.0 |
| dnnsoftware | dotnetnuke | 5.1.2 |
| dotnetnuke | dotnetnuke | 4.9.0 |
| dnnsoftware | dotnetnuke | 4.9.1 |
| dotnetnuke | dotnetnuke | 5.4.4 |
| dotnetnuke | dotnetnuke | 5.4.1 |
| dnnsoftware | dotnetnuke | 6.0.2 |
| dotnetnuke | dotnetnuke | 5.2.3 |
| dotnetnuke | dotnetnuke | 5.0.0 |
| dotnetnuke | dotnetnuke | 5.1.0 |
| dotnetnuke | dotnetnuke | 5.5.1 |
| dnnsoftware | dotnetnuke | 4.9.2 |
| dnnsoftware | dotnetnuke | 5.1.1 |
| dotnetnuke | dotnetnuke | 5.6.1 |
| dotnetnuke | dotnetnuke | 4.9.3 |
| dotnetnuke | dotnetnuke | 5.3.1 |
| dotnetnuke | dotnetnuke | 5.5.0 |
| dotnetnuke | dotnetnuke | 5.2.1 |
| dotnetnuke | dotnetnuke | 5.4.3 |
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 4.7.0 |
| dotnetnuke | dotnetnuke | 5.1.4 |
| dotnetnuke | dotnetnuke | 4.5.4 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 4.9 |
| dotnetnuke | dotnetnuke | 7.0.3 |
| dotnetnuke | dotnetnuke | * |
| dotnetnuke | dotnetnuke | 4.6.0 |
| dotnetnuke | dotnetnuke | 5.05.01 |
| dotnetnuke | dotnetnuke | 3.0.7 |
| dotnetnuke | dotnetnuke | 4.4.1 |
| dotnetnuke | dotnetnuke | 5.0 |
| dotnetnuke | dotnetnuke | 3.3.5 |
| dotnetnuke | dotnetnuke | 6.2.2 |
| dotnetnuke | dotnetnuke | 4.9.1 |
| dotnetnuke | dotnetnuke | 5.1.3 |
| dotnetnuke | dotnetnuke | 6.1.1 |
| dotnetnuke | dotnetnuke | 6.1.5 |
| dotnetnuke | dotnetnuke | 3.0.11 |
| dotnetnuke | dotnetnuke | 4.3.5 |
| dotnetnuke | dotnetnuke | 6.1.0 |
| dotnetnuke | dotnetnuke | 7.0.6 |
| dotnetnuke | dotnetnuke | 7.0.5 |
| dotnetnuke | dotnetnuke | 1.0.10e |
| dotnetnuke | dotnetnuke | 4.0 |
| dotnetnuke | dotnetnuke | 2.1.2 |
| dotnetnuke | dotnetnuke | 4.6.1 |
| dotnetnuke | dotnetnuke | 6.2.5 |
| dotnetnuke | dotnetnuke | 6.2.4 |
| dotnetnuke | dotnetnuke | 3.1.0 |
| dotnetnuke | dotnetnuke | 6.0.0 |
| dotnetnuke | dotnetnuke | 7.0.4 |
| dotnetnuke | dotnetnuke | 6.2.3 |
| dotnetnuke | dotnetnuke | 5.1.2 |
| dotnetnuke | dotnetnuke | 2.1.1 |
| dotnetnuke | dotnetnuke | 6.1.2 |
| dotnetnuke | dotnetnuke | 4.6.2 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 5.06.00 |
| dotnetnuke | dotnetnuke | 7.0.1 |
| dotnetnuke | dotnetnuke | 7.1.0 |
| dotnetnuke | dotnetnuke | 4.8.1 |
| dotnetnuke | dotnetnuke | 6.1.4 |
| dotnetnuke | dotnetnuke | 6.0.2 |
| dotnetnuke | dotnetnuke | 5.1.1 |
| dotnetnuke | dotnetnuke | 6.2.0 |
| dotnetnuke | dotnetnuke | 6.2.7 |
| dotnetnuke | dotnetnuke | 4.8.4 |
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 6.1.3 |
| dotnetnuke | dotnetnuke | 4.5.5 |
| dotnetnuke | dotnetnuke | 7.0.0 |
| dotnetnuke | dotnetnuke | 4.8.2 |
| dotnetnuke | dotnetnuke | 6.2.1 |
| dotnetnuke | dotnetnuke | 4.9.2 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
| dotnetnuke | dotnetnuke | 4.8.3 |
| dotnetnuke | dotnetnuke | 7.0.2 |
| dotnetnuke | dotnetnuke | 4.5.2 |
| dotnetnuke | dotnetnuke | 4.8.0 |
| dotnetnuke | dotnetnuke | 6.2.6 |
| dotnetnuke | dotnetnuke | 3.0.8 |
| dotnetnuke | dotnetnuke | 5.1 |
| dotnetnuke | dotnetnuke | 6.0.1 |
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 4.7.0 |
| dotnetnuke | dotnetnuke | 5.1.4 |
| dotnetnuke | dotnetnuke | 4.5.4 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 4.9 |
| dotnetnuke | dotnetnuke | 7.0.3 |
| dotnetnuke | dotnetnuke | * |
| dotnetnuke | dotnetnuke | 4.6.0 |
| dotnetnuke | dotnetnuke | 5.05.01 |
| dotnetnuke | dotnetnuke | 3.0.7 |
| dotnetnuke | dotnetnuke | 4.4.1 |
| dotnetnuke | dotnetnuke | 5.0 |
| dotnetnuke | dotnetnuke | 3.3.5 |
| dotnetnuke | dotnetnuke | 6.2.2 |
| dotnetnuke | dotnetnuke | 4.9.1 |
| dotnetnuke | dotnetnuke | 5.1.3 |
| dotnetnuke | dotnetnuke | 6.1.1 |
| dotnetnuke | dotnetnuke | 6.1.5 |
| dotnetnuke | dotnetnuke | 3.0.11 |
| dotnetnuke | dotnetnuke | 4.3.5 |
| dotnetnuke | dotnetnuke | 6.1.0 |
| dotnetnuke | dotnetnuke | 7.0.6 |
| dotnetnuke | dotnetnuke | 7.0.5 |
| dotnetnuke | dotnetnuke | 1.0.10e |
| dotnetnuke | dotnetnuke | 4.0 |
| dotnetnuke | dotnetnuke | 2.1.2 |
| dotnetnuke | dotnetnuke | 4.6.1 |
| dotnetnuke | dotnetnuke | 6.2.5 |
| dotnetnuke | dotnetnuke | 6.2.4 |
| dotnetnuke | dotnetnuke | 3.1.0 |
| dotnetnuke | dotnetnuke | 6.0.0 |
| dotnetnuke | dotnetnuke | 7.0.4 |
| dotnetnuke | dotnetnuke | 6.2.3 |
| dotnetnuke | dotnetnuke | 5.1.2 |
| dotnetnuke | dotnetnuke | 2.1.1 |
| dotnetnuke | dotnetnuke | 6.1.2 |
| dotnetnuke | dotnetnuke | 4.6.2 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 5.06.00 |
| dotnetnuke | dotnetnuke | 7.0.1 |
| dotnetnuke | dotnetnuke | 7.1.0 |
| dotnetnuke | dotnetnuke | 4.8.1 |
| dotnetnuke | dotnetnuke | 6.1.4 |
| dotnetnuke | dotnetnuke | 6.0.2 |
| dotnetnuke | dotnetnuke | 5.1.1 |
| dotnetnuke | dotnetnuke | 6.2.0 |
| dotnetnuke | dotnetnuke | 6.2.7 |
| dotnetnuke | dotnetnuke | 4.8.4 |
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 6.1.3 |
| dotnetnuke | dotnetnuke | 4.5.5 |
| dotnetnuke | dotnetnuke | 7.0.0 |
| dotnetnuke | dotnetnuke | 4.8.2 |
| dotnetnuke | dotnetnuke | 6.2.1 |
| dotnetnuke | dotnetnuke | 4.9.2 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
| dotnetnuke | dotnetnuke | 4.8.3 |
| dotnetnuke | dotnetnuke | 7.0.2 |
| dotnetnuke | dotnetnuke | 4.5.2 |
| dotnetnuke | dotnetnuke | 4.8.0 |
| dotnetnuke | dotnetnuke | 6.2.6 |
| dotnetnuke | dotnetnuke | 3.0.8 |
| dotnetnuke | dotnetnuke | 5.1 |
| dotnetnuke | dotnetnuke | 6.0.1 |
Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-20,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | 4.7.0 |
| dotnetnuke | dotnetnuke | 5.1.4 |
| dotnetnuke | dotnetnuke | 4.5.4 |
| dotnetnuke | dotnetnuke | 1.0.7 |
| dotnetnuke | dotnetnuke | 4.9 |
| dotnetnuke | dotnetnuke | 7.0.3 |
| dotnetnuke | dotnetnuke | * |
| dotnetnuke | dotnetnuke | 4.6.0 |
| dotnetnuke | dotnetnuke | 5.05.01 |
| dotnetnuke | dotnetnuke | 3.0.7 |
| dotnetnuke | dotnetnuke | 4.4.1 |
| dotnetnuke | dotnetnuke | 5.0 |
| dotnetnuke | dotnetnuke | 3.3.5 |
| dotnetnuke | dotnetnuke | 6.2.2 |
| dotnetnuke | dotnetnuke | 4.9.1 |
| dotnetnuke | dotnetnuke | 5.1.3 |
| dotnetnuke | dotnetnuke | 6.1.1 |
| dotnetnuke | dotnetnuke | 6.1.5 |
| dotnetnuke | dotnetnuke | 3.0.11 |
| dotnetnuke | dotnetnuke | 4.3.5 |
| dotnetnuke | dotnetnuke | 6.1.0 |
| dotnetnuke | dotnetnuke | 7.0.6 |
| dotnetnuke | dotnetnuke | 7.0.5 |
| dotnetnuke | dotnetnuke | 1.0.10e |
| dotnetnuke | dotnetnuke | 4.0 |
| dotnetnuke | dotnetnuke | 2.1.2 |
| dotnetnuke | dotnetnuke | 4.6.1 |
| dotnetnuke | dotnetnuke | 6.2.5 |
| dotnetnuke | dotnetnuke | 6.2.4 |
| dotnetnuke | dotnetnuke | 3.1.0 |
| dotnetnuke | dotnetnuke | 6.0.0 |
| dotnetnuke | dotnetnuke | 7.0.4 |
| dotnetnuke | dotnetnuke | 6.2.3 |
| dotnetnuke | dotnetnuke | 5.1.2 |
| dotnetnuke | dotnetnuke | 2.1.1 |
| dotnetnuke | dotnetnuke | 6.1.2 |
| dotnetnuke | dotnetnuke | 4.6.2 |
| dotnetnuke | dotnetnuke | 1.0.9 |
| dotnetnuke | dotnetnuke | 5.06.00 |
| dotnetnuke | dotnetnuke | 7.0.1 |
| dotnetnuke | dotnetnuke | 7.1.0 |
| dotnetnuke | dotnetnuke | 4.8.1 |
| dotnetnuke | dotnetnuke | 6.1.4 |
| dotnetnuke | dotnetnuke | 6.0.2 |
| dotnetnuke | dotnetnuke | 5.1.1 |
| dotnetnuke | dotnetnuke | 6.2.0 |
| dotnetnuke | dotnetnuke | 6.2.7 |
| dotnetnuke | dotnetnuke | 4.8.4 |
| dotnetnuke | dotnetnuke | 1.0.6 |
| dotnetnuke | dotnetnuke | 6.1.3 |
| dotnetnuke | dotnetnuke | 4.5.5 |
| dotnetnuke | dotnetnuke | 7.0.0 |
| dotnetnuke | dotnetnuke | 4.8.2 |
| dotnetnuke | dotnetnuke | 6.2.1 |
| dotnetnuke | dotnetnuke | 4.9.2 |
| dotnetnuke | dotnetnuke | 1.0.8 |
| dotnetnuke | dotnetnuke | 1.0.10d |
| dotnetnuke | dotnetnuke | 4.8.3 |
| dotnetnuke | dotnetnuke | 7.0.2 |
| dotnetnuke | dotnetnuke | 4.5.2 |
| dotnetnuke | dotnetnuke | 4.8.0 |
| dotnetnuke | dotnetnuke | 6.2.6 |
| dotnetnuke | dotnetnuke | 3.0.8 |
| dotnetnuke | dotnetnuke | 5.1 |
| dotnetnuke | dotnetnuke | 6.0.1 |
Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | * |
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-264,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | * |
Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| dotnetnuke | dotnetnuke | * |