dotnetblogengine records

7 published records for vendor dotnetblogengine.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
37Monitor	CVE-2019-10719No exploit	BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /apidotnetblogengine · blogengine.net · CWE-22 RCE Path traversal	High8.8	—	7.6%	Jun 21, 2019
31Monitor	CVE-2019-10718No exploit	BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/dotnetblogengine · blogengine.net · CWE-611 Pre-auth XXE	High7.5	—	2.7%	Jun 21, 2019
30Monitor	CVE-2019-10717Proof of concept	BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.dotnetblogengine · blogengine.net · CWE-22 Path traversal	High7.1	—	5.4%	Jul 3, 2019
30Monitor	CVE-2019-11392No exploit	BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.dotnetblogengine · blogengine.net · CWE-611 Pre-auth XXE	High7.5	—	1.6%	Jun 21, 2019
24Monitor	CVE-2019-10721No exploit	BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Securitdotnetblogengine · blogengine.net · CWE-601 Pre-auth Open redirect	Medium6.1	—	1.0%	Jul 3, 2019
20Monitor	CVE-2013-6953No exploit	BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.dotnetblogengine · blogengine.net · CWE-200 Pre-auth Info leak	Medium5.0	—	1.3%	Jan 3, 2014
17Monitor	CVE-2008-6476Proof of concept	Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTMdotnetblogengine · blogengine.net · CWE-79 Pre-auth XSS	Medium4.3	—	1.5%	Mar 16, 2009

CVE-2019-10719
37Monitor
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api
HighCVSS 8.8No exploitEPSS 8%
- RCE
- Path traversal
dotnetblogengine · blogengine.netJun 21, 2019
CVE-2019-10718
31Monitor
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
- XXE
dotnetblogengine · blogengine.netJun 21, 2019
CVE-2019-10717
30Monitor
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
HighCVSS 7.1Proof of conceptEPSS 5%
- Path traversal
dotnetblogengine · blogengine.netJul 3, 2019
CVE-2019-11392
30Monitor
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- XXE
dotnetblogengine · blogengine.netJun 21, 2019
CVE-2019-10721
24Monitor
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Securit
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- Open redirect
dotnetblogengine · blogengine.netJul 3, 2019
CVE-2013-6953
20Monitor
BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
MediumCVSS 5.0No exploitEPSS 1%
- Pre-auth
- Info leak
dotnetblogengine · blogengine.netJan 3, 2014
CVE-2008-6476
17Monitor
Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTM
MediumCVSS 4.3Proof of conceptEPSS 1%
- Pre-auth
- XSS
dotnetblogengine · blogengine.netMar 16, 2009