Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. Description An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads.
Recommended action: Upgrade to 10.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. Details The new out-of-box experience blocks that endpoint to unauthenticated users. If there is a real need for the implementation to allow unauthenticated uploads, then the web.config can be edited by the implementer to remove that block and open the endpoint to the public.
Recommended action: Upgrade to 10.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN.PLATFORM allows a specially crafted series of malicious interaction can expose NTLM hashes to a third party SMB server. This vulnerability is fixed in 10.0.1.
Recommended action: Upgrade to 10.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN.PLATFORM allows a specially crafted request or proxy to be created that would bypass the design of DNN Login IP Filters allowing login attempts from IP Adresses not in the allow list. This vulnerability is fixed in 10.0.1.
Recommended action: Upgrade to 10.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN.PLATFORM allows a specially crafted request can inject scripts in the Activity Feed Attachments endpoint which will then render in the feed, resulting in a cross-site scripting attack. This vulnerability is fixed in 10.0.1.
Recommended action: Upgrade to 10.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DNN.PLATFORM allows specially crafted content in URLs could be used with TokenReplace and not be properly sanitized by some SkinObjects. This vulnerability is fixed in 10.0.1.
Recommended action: Upgrade to 10.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.