Dotnetblogengine
Dotnetblogengine Blogengine.net: vulnerabilidades y CVE
Dotnetblogengine Blogengine.net tiene 7 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-10721 | Media (6.1) | 0.97% | — | 3 jul 2019 | BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx. |
| CVE-2019-10717 | Alta (7.1) | 5.4% | — | 3 jul 2019 | BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter. |
| CVE-2019-11392 | Alta (7.5) | 1.6% | — | 21 jun 2019 | BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd. |
| CVE-2019-10719 | Alta (8.8) | 7.6% | — | 21 jun 2019 | BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue… |
| CVE-2019-10718 | Alta (7.5) | 2.7% | — | 21 jun 2019 | BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs. |
| CVE-2013-6953 | Media (5) | 1.3% | — | 3 ene 2014 | BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file. |
| CVE-2008-6476 | Media (4.3) | 1.5% | — | 16 mar 2009 | Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter. |