Vulnerabilities

TI-2023-16523 CVE-2023-33404 · GHSA-8vr7-mc5w-34ff

An Unrestricted Upload vulnerability, due to insufficient validation on…

HIGH 82

An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.25782 Published 2023-06-26 No fix listed CWE-434

TI-2023-16524 CVE-2023-33405 · GHSA-9qvp-qqr3-gfx3

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

MEDIUM 60

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.31265 Published 2023-06-21 No fix listed CWE-601

TI-2023-09012 CVE-2023-22858 · GHSA-8j76-g3f2-ff7f

Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

LOW 30

An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00427 Published 2023-03-06 No fix listed CWE-552

TI-2023-09011 CVE-2023-22857 · GHSA-9fh7-6w63-mwj7

Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

LOW 37

A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00362 Published 2023-03-06 No fix listed CWE-79

TI-2023-09010 CVE-2023-22856 · GHSA-3f3v-9mp5-jfjc

Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

LOW 39

A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00375 Published 2023-03-06 No fix listed CWE-79

TI-2022-19878 CVE-2022-41417 · GHSA-fg9c-fh23-jcmv

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.

MEDIUM 50

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00793 Published 2023-01-18 No fix listed CWE-862

TI-2022-19879 CVE-2022-41418 · GHSA-mfh9-9gwj-9822

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of…

LOW 36

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01259 Published 2022-12-19 No fix listed CWE-22

TI-2022-16901 CVE-2022-36600 · GHSA-phv4-2qx4-j6w7

BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability…

LOW 23

BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00561 Published 2022-09-02 No fix listed CWE-79

TI-2022-11531 CVE-2022-28921 · GHSA-f73j-5m2f-qvhw

A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0…

LOW 30

A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0074 Published 2022-05-18 No fix listed CWE-352

TI-2022-09183 CVE-2022-25591 · GHSA-j52p-f3h5-4qxx

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion…

MEDIUM 44

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02722 Published 2022-05-13 No fix listed CWE-22

TI-2019-07998 CVE-2019-10720 · GHSA-hcx8-w26r-5c8f

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution…

MEDIUM 48

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07006 Published 2019-06-21 No fix listed CWE-22

TI-2018-10391 CVE-2018-14485 · GHSA-j2c4-rr9q-8j5c

BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.

MEDIUM 59

BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.16287 Published 2019-05-07 No fix listed CWE-611

TI-2019-04757 CVE-2019-6714 · GHSA-hm39-3528-68f4

An issue was discovered in BlogEngine.NET through 3.3.6.0.

HIGH 66

An issue was discovered in BlogEngine.NET through 3.3.6.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.31725 Published 2019-03-17 No fix listed CWE-22

TI-2014-03895 CVE-2014-4736 · GHSA-vr78-cpqr-qr3p

SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute…

LOW 37

SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02348 Published 2014-07-24 No fix listed CWE-89

Vulnerabilities

Filters