Skip to content
OpenAdvisories

Package · NuGet

DotNetNuke.Core

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-12562 Public exploit

    Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

    Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing conten…

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-18326 Public exploit EPSS 54%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-18325 Exploited Public exploit EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15812 Public exploit EPSS 47%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-15811 Exploited Public exploit EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-9822 Exploited · Ransomware Public exploit EPSS 95%

    DNN (aka DotNetNuke) has Remote Code Execution via a cookie

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

    DotNetNuke DotNetNuke CMS Fixed in 9.1.1 DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2015-2794 Public exploit EPSS 75%

    The installation wizard in DotNetNuke (DNN) allows privilege escalation

    The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.

    DotNetNuke.Core NuGet
  • Medium —
    CVE-2008-6540 Public exploit

    DotNetNuke Default Machine Key Exposure

    DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restric…

    DotNetNuke.Core NuGet