CVE Vulnerability Advisory Database

[Affected Scope] DotNetNuke (DNN) Platform versions 9.2 through 9.2.2.

[Impact] Attackers can bypass security controls due to weak encryption of input parameters, leading to .NET deserialization and Remote Code Execution (RCE) via malicious cookies.

[Mitigation] Immediately upgrade the DNN Platform to version 9.3.0 or higher, and ensure secure machineKey configurations are applied.

[Affected Scope] DotNetNuke (DNN) Platform versions 9.2.0 through 9.2.1

[Impact] Attackers can exploit weak cryptographic algorithms to decrypt, forge, and inject malicious serialized .NET payloads into cookies, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade DNN Platform to version 9.2.2 or higher, and regenerate the MachineKey in web.config

[Affected Scope] Java web applications utilizing Primetek PrimeFaces framework version 5.x and below

[Impact] Unauthenticated remote attackers can exploit weak encryption keys to inject arbitrary serialized objects, leading to Remote Code Execution (RCE) on the target server

[Mitigation] Upgrade PrimeFaces to a secure version (6.0 or higher) and configure a strong, unique custom secret key in web.xml

[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2

[Impact] Remote attackers can exploit weak encryption to perform unrestricted file uploads or execute arbitrary code on the target server

[Mitigation] Upgrade to the latest patched version of Telerik UI, or configure strong custom encryption keys in web.config