Code Monkey home page Code Monkey logo

hubspot-easydnnnews-blog-migrator's Introduction

Upendo's HubSpot to EasyDNN News Blog Content Migration Module

This module helps a website owner migrate from using the HubSpot blogging engine, to EasyDNN News (by EasyDnnSolutions.com).

Prerequisites

  • DNN Platform 09.11.00+
  • EasyDNN News 11.09.00+ (must already be installed)

Features

Allows you to use the HubSpot API to authenticate using OAuth, to import blog content from HubSpot to the EasyDNN News module.

Allows you to import blog files into the EasyDNN News folder format, as a separate feature. (Also works for WordPress images... Just saying!!)


Hello, fellow DNN'er!

This solution was built using the Upendo DNN Generator. Anything you need to know about using this tool can be found there.

However, the rest of the README below is quite detailed in explaining how this solution is expected to work. Have fun writing code!


Sponsors == (typeOf superHuman) Awesome;

Yes, it's not real code. It's just supposed to be fun. :P

The tool that generated this solution is created and maintained by Upendo Ventures for the DNN CMS Community. Please consider sponsoring us for this and the many other open-source efforts we do. It's a lot. ;)

  • Sponsor Us (we're grateful at any level ๐Ÿ™๐Ÿฝ)

Developers Only ๐Ÿค“

If you're not a developer, the rest of this README is not going to interest you. ๐Ÿ˜‰


A Special Note to ALL Developers...
Please do not begin any development until you first read through and understand all of the notes in the README below.

Background

The previous version was not adhering to known best practices and as a result, it was unclear of how to find and maintain it. This version has been cleaned up and restructured with best practice architecture, build, versioning, and deployment in mind.

Solution

The solution currently expects to be in the following environment, but you can update that to be any version you'd like, provided all extensions will be compatible:

  • DNN: 09.08.00
  • Hotcakes Commerce: 03.06.00
  • SQL: 2017+

You should build and develop in a development environment that's separate from the local environment where you'd be testing. The examples below help to illustrate this...

  • Development Path: C:\Work\ProjectName\source-code\
  • Staging/Testing Path: C:\Work\ProjectName\website\

The Development Path is where the source code (solution) should be contained. The Staging/Testing Path is where the testing website instance should be restored to and ran from via IIS.

While you can technically do everything from a single path, this model helps to reduce environmental synchronization, duplication, and testing issues. It also often reduces ramp up time between testing scenarios where installations, upgrades, back-ups, and restorations are necessary.

Either way, is up to you.

Getting Started

You should get a backup of the website and database from production, then overwrite those files using this repo. (Optional) It may be a good idea to run a data cleansing script against the database to clear out any sensitive data and/or PII.

Builds

There are two possible paths for development, building and testing related to the suggested approach for this solution.

  1. Restore the website to the Development Path. When you build, test the updates from that path.
  2. Restore the website to the Staging/Testing Path. When you build, you'll need to install the extensions into this website.

Please Note: It's possible to follow both approaches. This allows the website in your Staging/Testing Path to remain as clean as possible and be a true test before deploying to a true staging environment and/or in production.

Debug Mode

When you build the solution or any single project in DEBUG mode, the following occurs:

  • All source code is built in debug mode.
  • Any relevant DLL's are generated and placed into the /website/Bin/ folder.
  • Any relevant files needed to see/use the extensions are placed into their respective locations (e.g., DesktopModules, Portals, Skins, Containers, etc.).

Release Mode

When you build the solution or any single project in RELEASE mode, the following occurs:

  • All source code is built in debug mode.
  • All extensions are packaged into installable DNN extension packages.
  • Extensions will be found in their respective folders in the /website/Install folder:
    • Hotcakes-Integration: Contains Hotcakes Commerce viewsets. (This is an non-standard folder that DNN is unaware of.)
    • Library: Contains class libraries (DLL's).
    • Module: Contains custom modules and skin objects.
    • Skin: Contains theme packages.

When there are DLL's involved, there are two packages created, Install and Symbols. The respective work will be seen at the end of the respective file name.

  • Install: Used to install or upgrade an extension.
  • Symbols: Used to install the PDB files for the DLL's in the installation package. Used for troubleshooting only. Always remember to uninstall the symbols when you're done troubleshooting.

Special Developer Note
If you don't remember to uninstall the symbols package, it could result in upgrade and/or troubleshooting issues in the future.

Development Environment

Steps 1 through 8 are considered to be more for set-up, while the remaining steps are for ongoing development.

  1. Fork/install source code (see suggested paths above).
  2. Create a database and restore a backup from production. Add a user to the database that has db_owner permissions.
  3. Update the PortalAlias table to add your new website domain name and make sure it's marked as the "Primary" domain name for the respective PortalID.
  4. Restore a copy of the website backup to the /website folder (create the /website folder in the root, if necessary)
  5. Update the web.config to have the updated database connection string.
  6. Update the Hosts file to have the new domain name (if necessary).
  7. Update IIS to point to the desired /website folder(s).
  8. View the website in your preferred web browser.
  9. Open the solution.
  10. Ensure that the solution can build in both DEBUG and RELEASE modes.
  11. Update the code and build as necessary (see build notes above).
  12. Build in Debug mode will push the code updates into the Website\DesktopModules folder (for modules, and other areas for other extensions, such as \Bin for Libraries)
  13. Build in Release mode will create the release packages in the Install\ExtensionType folder (e.g., Skins, Modules, Libraries, etc.)

Solution Folder Architecture

Here is an explanation of each of the top-level folders found in the solution. These folders are also reflected the same way when viewed in Visual Studio, when necessary.

  • Assets: Contains any dependencies or backup files that may be necessary (except website/database backups).
  • Build: Contains supporting files that enable the build processes mentioned above. These files should usually not be changed.
  • Libraries: Contains class librarys that either deploy on their own, and/or are deployed within another packaged extension.
  • Modules: Contains modules.
  • References: Contains references that may be used by one or many of the projects in the solution.
  • Skin-Objects: Contains skin objects that the theme might need to use.
  • Skins: Contains theme packages (skins and containers).
  • Viewsets: Contains Hotcakes Commerce viewset packages.
  • Website: This is discussed earlier in this document.

There is a packages that may be created as a result of building the solution or a project. This is created by Nuget and is not part of this solution architecture.

First Time Builds & Deployments

When an extension is new to the solution, there may be an extra bit of setup required.

  1. Build the extension in DEBUG mode so the deployment files are put into their respective places.
  2. View the website and login as a superuser.
  3. Manually install the extension in the Extensions view by using it's manifest file.
  4. If there are any database dependencies, manually run the SqlDataProvider file(s) to make the necessary schema updates to the database.
  5. Add the extension to a page or otherwise use it as it's intended.

Alternatively, you can build the solution in RELEASE mode and install that package into the website. Then build the solution/project again in DEBUG mode.

Debugging

In order to debug the code, you'll need to follow the steps below:

  1. Open Visual Studio using the "As Administrator" option in Windows.
  2. Build the project(s) solution in DEBUG mode.
  3. Ensure that the web.config is set to allow debugging: <compilation debug="true" strict="false" optimizeCompilations="true">
  4. Run the website and view the page that contains the code you wish to debug.
  5. In Visual Studio, choose the Debug > Attach to Process feature (a.k.a., <Ctrl>+<Alt>+<P>).
  6. Find w3wp.exe in the list and click the Attach button.
  7. Set any breakpoints that you wish to hit and step through.
  8. View the page again and/or perform the steps necessary to hit the breakpoint.

Adding/Updating References

Any references that can't or shouldn't be managed by Nuget are managed by the SolutionReferences.targets file in the Build folder. This central file allows you to update the references in a single place, for all projects.

If you're adding/editing references that come from DNN (or from the References folder), DO NOT use the Visual Studio IDE to do this. It will result in long-term management issues for the solution. Instead, you should view any of the .csproj files in a separate text editor to see how to properly add a reference. It's not possible to add it correctly in the Visual Studio IDE.

General Instructions

When necessary, first add the new references to the correct references folder/path, and then update the SolutionReferences.targets file.

Include the following line in the .csproj file, just before the references section (if necessary).

<Import Project="..\..\Build\SolutionReferences.targets" Condition="false" />

Please Note: It's currently required for you to manually update the version numbers in the .csproj file when working with any Library type project as well. Please see Issue #17 for more details and to potentially help fix this. :)

Next, add the appropriate reference, per the targets file. Here are examples for DNN, and Hotcakes Commerce.

  <ItemGroup>
    <Reference Include="DotNetNuke">
      <SpecificVersion>False</SpecificVersion>
      <HintPath>$(DnnReferencePath)\DotNetNuke.dll</HintPath>
      <Private>False</Private>
    </Reference>
    <Reference Include="Hotcakes.Commerce">
      <SpecificVersion>False</SpecificVersion>
      <HintPath>$(HccReferencePath)\Hotcakes.Commerce.dll</HintPath>
      <Private>False</Private>
    </Reference>
  </ItemGroup>

Note the use of SpecificVersion and Private above. These are very important to ensuring consistent builds and packages.

If you reference a DLL in the references folder directly, simply edit the .csproj file afterward to follow the pattern outlined above.

Source Control

It may be noticed that this solution and it's architecture are both complicated and elegant at the same time. A beginning developer may feel overwhelmed at first, but this solution greatly simplifies all development. This is especially important and true due to how tightly integrated and dependant all of the projects and code is.

Solution

As such, this solution would function best when used with a Git-based source control product, such as Git, GitHub, and BitBucket. There are many workflows that could be used for this solution as it relates to the interaction with Git. For developers that are new to Git and its potential workflows, a workflow known as "centralized workflow" may be tempting, because it is how solo developers and SVN/TFS has been used in the past. When using Git, this is generally a mistake since it ignores all of the features Git offers.

Workflow

It is highly recommended that a Gitflow Workflow workflow is used and followed. This empowers all developers that may be involved to work at the same time, independently, regardless of location, focus, and feature/issue they're working on. Initially, some developers will feel this simply over-complicates the development process, but the moment something "bad" happens during a development cycle, this process will very clearly highlight itself as having saved the day. This approach also ensures that one or more PM's are able to see and know the state of the code base, pending updates, and more because they're at all times seeing branches in a logical pattern and reviewing pull requests to the primary/release branches.

Branches

The primary branches that are present and used may change over time. Those potential branches are defined below. There are no strict requirements, except as defined as the project/product manager assigned to this solution. Naming conventions such as those listed below are very important to ensure the productivity of all parties involved during development, so that everyone can easily understand the purpose of various branches and their contained code/updates.

  • main - A main (formerly known as Master) branch should always be present and used, regardless of the way Git is leveraged. This branch is always expected to only contain tested and unbroken code at all times. At no time should code be committed to this branch without first being verified to be tested and unbroken. Pull requests into this branch would often only come from the development branch.
  • development - A development branch is not currently being used and it is not necessarily required moving forward, depending on how development will be done in the future. It is best used when development is expected to follow a more strict schedule or versioning pattern. If continuous integration (CI) or similar solutions are to be integrated, this branch will also become necessary. This branch is where other branches are merged to first, before being determined to be production-ready. Once the code is merged to the development branch, a QA engineer would smoke and regression test the code in this branch. Once all updates are verified to be correct and not break other existing features, the code in this branch would then be merged into the master branch as part of a release process/cycle. This code would also be what is used to push into a staging/UAT environment. Pull requests generally would always come to this branch, and not to the master branch.
  • Issues\name-number - This is a common branching naming convention when working on bugs. The name/number would reference a work item/task ID or a very short name to identify the update. Examples of this naming convention would include Issues\Issue-12345 and Issues\email-template-routing.
  • Features\name-number - This is a common branching naming convention when adding new features. The name/number would reference a work item/task ID or a very short name to identify the update. Examples of this naming convention would include Features\Issue-12345 and Features\salesforce-integration.
  • Tasks\name-number - This is a common branching naming convention when working on tasks that aren't necessarily a new feature or bug fix. The name/number would reference a work item/task ID or a very short name to identify the update. Examples of this naming convention would include Tasks\Issue-12345 and Tasks\03.02.01-packaging.
  • Releases\version - This naming convention and its branches are only necessary when following a release schedule that's highly focused on a product management approach that includes versioning. Ideally, in this scenario, all projects would always have the same version. This workflow would be ideal for a solution like this, but it also depends on the level of and availability of resources assigned to the project. Having such a approach also helps to identify and troubleshoot differences over time. An example of a branch using this approach would be Releases\03.02.01. The code that is included in this branch would come only from the master branch, and this branch would be created directly prior to pushing the updates into production from a staging/UAT environment.

Support for this Project

This solution and the related materials are proudly created and provided by Upendo Ventures.

hubspot-easydnnnews-blog-migrator's People

Contributors

alejoroman0605 avatar libanlsilva avatar mend-bolt-for-github[bot] avatar willstrohl avatar

Stargazers

 avatar

Watchers

 avatar

hubspot-easydnnnews-blog-migrator's Issues

Validation is too aggressive

Sponsorship

If this request requires additional support (e.g., such as direct email/phone/meeting/development), I have the following interest in helping to sponsor the effort via GitHub Sponsors:

  • None, please continue to work for me for free :P
  • Absolutely, I get value out of this!
  • Maybe later
  • I'm already a sponsor... Woot!

Describe the bug

When you intend to save the app settings, it attempts to validate the settings as you'd expect, but also the image path. The settings won't save.

Software Versions

  • DNN: 09.13.01
  • Module: 01.00.00

To Reproduce

Steps to reproduce the behavior:

  1. Install the module and add it to a page.
  2. Attempt to add valid settings to the app settings area.
  3. Click to save the settings.

Expected behavior

The settings are saved. No other fields are validated. Visual feedback appears to let us know the settings were saved.

Actual behavior

Not sure if the settings were saved or not when this happens. The image path field is throwing an error that is' required. That is a different button that should be validating the image path.

While troubleshooting, I can confirm that the settings are saved, but it's not obvious when you're using the module.

Screenshots

image

Error log

Nothing to report.

Additional context

None at this time.

DotNetNuke-9.8.0.0.dll: 1 vulnerabilities (highest severity is: 4.9)

Vulnerable Library - DotNetNuke-9.8.0.0.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (DotNetNuke version) Remediation Possible**
CVE-2022-2922 Medium 4.9 DotNetNuke-9.8.0.0.dll Direct DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2922

Vulnerable Library - DotNetNuke-9.8.0.0.dll

DotNetNuke

Library home page: https://api.nuget.org/packages/dotnetnuke.core.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.dll

Dependency Hierarchy:

  • โŒ DotNetNuke-9.8.0.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

Publish Date: 2022-09-30

URL: CVE-2022-2922

CVSS 3 Score Details (4.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9w72-2f23-57gm

Release Date: 2022-09-30

Fix Resolution: DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0

Step up your Open Source Security Game with Mend here

Add a validation to inform the user that they have already migrated their posts to HubSpot.

You should consider adding a validation to alert the user if you have already completed a migration of your posts into HubSpot. This validation could inform them that if they press the 'Migrate Posts' button again, the data will be duplicated.

Steps to replicate the problem:

  • Install the module on a page.
  • Configure the settings to connect with HubSpot.
  • Perform the authentication flow.
  • Migrate the posts using the Migrate Posts button.
  • Press the Migrate Posts button again.

Current behavior

HubSpot posts are migrated again, so the information is duplicated.

Expected behavior

Posts should not be migrated again.

Improve the First-Time User Experience

Sponsorship

If this request requires additional support (e.g., such as direct email/phone/meeting/development), I have the following interest in helping to sponsor the effort via GitHub Sponsors:

  • None, please continue to work for me for free :P
  • Absolutely, I get value out of this!
  • Maybe later
  • I'm already a sponsor... Woot!

Is your feature request related to a problem?

If you're using this module for the first time, it's not clear how it works. It would be confusing to anyone at first.

Describe the solution you'd like

Implement a tabbed UI that separates the authentication, settings, and image migration UI elements.

The Settings should be on the same tab. The Auth should be the second tab. The image migration is on the last tab.

This segmentation will better convey the path to use the features in a visual manner.

Describe alternatives you've considered

None yet, but open to suggestions.

Additional context

None at this time.

ICSharpCode.SharpZipLib.dll: 1 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - ICSharpCode.SharpZipLib.dll

ICSharpCode.SharpZipLibrary

Library home page: https://api.nuget.org/packages/netsword.common.icsharpcode.sharpziplib.0.84.0.nupkg

Path to vulnerable library: /Build/ICSharpCode.SharpZipLib.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (ICSharpCode.SharpZipLib.dll version) Remediation Possible**
CVE-2018-1002208 Medium 5.5 ICSharpCode.SharpZipLib.dll Direct SharpZipLib - 1.0.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-1002208

Vulnerable Library - ICSharpCode.SharpZipLib.dll

ICSharpCode.SharpZipLibrary

Library home page: https://api.nuget.org/packages/netsword.common.icsharpcode.sharpziplib.0.84.0.nupkg

Path to vulnerable library: /Build/ICSharpCode.SharpZipLib.dll

Dependency Hierarchy:

  • โŒ ICSharpCode.SharpZipLib.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Publish Date: 2018-07-25

URL: CVE-2018-1002208

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1002208

Release Date: 2018-07-25

Fix Resolution: SharpZipLib - 1.0.0

Step up your Open Source Security Game with Mend here

Implementation of Data Entry for Categories and Tags

I've noticed that the HubSpot API only provides category and tag IDs, but not their names. Currently, we are generating the categories and tags using a generic name and the ID provided by HubSpot.
var defaultCategoryName = $"{Constant.DefaultCategoryName}{item.CategoryId}";
var name = $"hubspotTagId{tagId}";

As a proposal for improvement, I suggest implementing an early data entry system for categories and tags. This system would allow a list of (category, id) and (tag, id) pairs to be entered beforehand.

I think this improvement would allow us to avoid manual fixes later, saving time and reducing the possibility of errors.
Greetings,

axios-1.6.0.tgz: 2 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - axios-1.6.0.tgz

Path to dependency file: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Path to vulnerable library: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (axios version) Remediation Possible**
CVE-2024-28849 Medium 6.5 follow-redirects-1.15.3.tgz Transitive N/A* โŒ
CVE-2023-26159 Medium 6.1 follow-redirects-1.15.3.tgz Transitive 1.6.1 โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28849

Vulnerable Library - follow-redirects-1.15.3.tgz

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz

Path to dependency file: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Path to vulnerable library: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Dependency Hierarchy:

  • axios-1.6.0.tgz (Root Library)
    • โŒ follow-redirects-1.15.3.tgz (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

Step up your Open Source Security Game with Mend here

CVE-2023-26159

Vulnerable Library - follow-redirects-1.15.3.tgz

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz

Path to dependency file: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Path to vulnerable library: /Modules/HubSpotEasyDnnNewsBlogMigrator/client-app/package.json

Dependency Hierarchy:

  • axios-1.6.0.tgz (Root Library)
    • โŒ follow-redirects-1.15.3.tgz (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (axios): 1.6.1

Step up your Open Source Security Game with Mend here

DotNetNuke.Modules.DigitalAssets-9.8.0.0.dll: 1 vulnerabilities (highest severity is: 5.4)

Vulnerable Library - DotNetNuke.Modules.DigitalAssets-9.8.0.0.dll

DotNetNuke.Modules.DigitalAssets

Library home page: https://api.nuget.org/packages/dotnetnuke.bundle.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.Modules.DigitalAssets.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (DotNetNuke.Modules.DigitalAssets version) Remediation Possible**
CVE-2022-47053 Medium 5.4 DotNetNuke.Modules.DigitalAssets-9.8.0.0.dll Direct DotNetNuke.Bundle - 9.11.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-47053

Vulnerable Library - DotNetNuke.Modules.DigitalAssets-9.8.0.0.dll

DotNetNuke.Modules.DigitalAssets

Library home page: https://api.nuget.org/packages/dotnetnuke.bundle.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.Modules.DigitalAssets.dll

Dependency Hierarchy:

  • โŒ DotNetNuke.Modules.DigitalAssets-9.8.0.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.

Publish Date: 2023-04-12

URL: CVE-2022-47053

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.dnnsoftware.com/community/security/security-center#:~:text=XSS%20in%20Digital%20Asset%20Manager

Release Date: 2023-04-12

Fix Resolution: DotNetNuke.Bundle - 9.11.0

Step up your Open Source Security Game with Mend here

ICSharpCode.SharpZipLib-0.86.0.518.dll: 1 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - ICSharpCode.SharpZipLib-0.86.0.518.dll

SharpZipLib for .NET Framework 2.0

Library home page: https://api.nuget.org/packages/icsharpcode.sharpziplib.0.86.0.518.nupkg

Path to vulnerable library: /References/DNN/09.08.00/ICSharpCode.SharpZipLib.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (ICSharpCode.SharpZipLib version) Remediation Possible**
CVE-2018-1002208 Medium 5.5 ICSharpCode.SharpZipLib-0.86.0.518.dll Direct SharpZipLib - 1.0.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-1002208

Vulnerable Library - ICSharpCode.SharpZipLib-0.86.0.518.dll

SharpZipLib for .NET Framework 2.0

Library home page: https://api.nuget.org/packages/icsharpcode.sharpziplib.0.86.0.518.nupkg

Path to vulnerable library: /References/DNN/09.08.00/ICSharpCode.SharpZipLib.dll

Dependency Hierarchy:

  • โŒ ICSharpCode.SharpZipLib-0.86.0.518.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Publish Date: 2018-07-25

URL: CVE-2018-1002208

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1002208

Release Date: 2018-07-25

Fix Resolution: SharpZipLib - 1.0.0

Step up your Open Source Security Game with Mend here

Newtonsoft.Json-10.0.3.21018.dll: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - Newtonsoft.Json-10.0.3.21018.dll

Json.NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.10.0.3.nupkg

Path to vulnerable library: /References/DNN/09.08.00/Newtonsoft.Json.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (Newtonsoft.Json version) Remediation Possible**
CVE-2024-21907 High 7.5 Newtonsoft.Json-10.0.3.21018.dll Direct Newtonsoft.Json - 13.0.1 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21907

Vulnerable Library - Newtonsoft.Json-10.0.3.21018.dll

Json.NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.10.0.3.nupkg

Path to vulnerable library: /References/DNN/09.08.00/Newtonsoft.Json.dll

Dependency Hierarchy:

  • โŒ Newtonsoft.Json-10.0.3.21018.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Publish Date: 2024-01-03

URL: CVE-2024-21907

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2024-01-03

Fix Resolution: Newtonsoft.Json - 13.0.1

Step up your Open Source Security Game with Mend here

SI: FK Violation Error Occurring

Sponsorship

If this request requires additional support (e.g., such as direct email/phone/meeting/development), I have the following interest in helping to sponsor the effort via GitHub Sponsors:

  • None, please continue to work for me for free :P
  • Absolutely, I get value out of this!
  • Maybe later
  • I'm already a sponsor... Woot!

Describe the bug

When using the migrator, there could be exceptions that occur which cause the tool to fail related to attempts to add a new tag. This occurs when it already exists.

Software Versions

  • DNN: 09.13.01
  • Module: 01.01.00

To Reproduce

Steps to reproduce the behavior:

  1. Put the module on a page and correctly configure it and a HubSpot instance.
  2. Click the Login to Hubspot button to get started.
  3. Click the "Migrate" button to begin the migration process.

Expected behavior

All of the blog posts are imported into DNN, allowing us to proceed to the next step. No errors occur or are reported.

We can see a summary of the number of posts that were found, versus the number of posts that were successfully imported.

Actual behavior

Only a subset of the blogs are imported and a number of errors are logged into the Log4NET log file. The UI makes it look like everything happened as expected, despite there being numerous exceptions, and not all of the posts were imported.

Screenshots

N/A

Error log

2024-04-11 16:12:38.530-04:00 [DWURF0][D:4][T:291][ERROR] UpendoVentures.Modules.HubSpotEasyDnnNewsBlogMigrator.Repository.EasyDNNNewsGenericRepository`1[[UpendoVentures.Modules.HubSpotEasyDnnNewsBlogMigrator.Models.EasyDNNNewsTagsItems, UpendoVentures.Modules.HubSpotEasyDnnNewsBlogMigrator, Version=1.1.0.0, Culture=neutral, PublicKeyToken=null]] - System.Data.SqlClient.SqlException (0x80131904): The INSERT statement conflicted with the FOREIGN KEY constraint "FK_EasyDNNNewsTagsItems_EasyDNNNewsNewTags". The conflict occurred in database "dnn", table "dbo.EasyDNNNewsNewTags", column 'TagID'.
The statement has been terminated.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)
   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)
   at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)
   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted)
   at System.Data.SqlClient.SqlCommand.CompleteAsyncExecuteReader(Boolean isInternal, Boolean forDescribeParameterEncryption)
   at System.Data.SqlClient.SqlCommand.InternalEndExecuteNonQuery(IAsyncResult asyncResult, String endMethod, Boolean isInternal)
   at System.Data.SqlClient.SqlCommand.EndExecuteNonQueryInternal(IAsyncResult asyncResult)
   at System.Data.SqlClient.SqlCommand.EndExecuteNonQueryAsync(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Dapper.SqlMapper.<ExecuteImplAsync>d__39.MoveNext() in /_/Dapper/SqlMapper.Async.cs:line 662
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at UpendoVentures.Modules.HubSpotEasyDnnNewsBlogMigrator.Repository.EasyDNNNewsGenericRepository`1.<AddAsync>d__3.MoveNext()
ClientConnectionId:075ee6e1-7f10-4391-81e0-2b5f6fc01c4f
Error Number:547,State:0,Class:16

Additional context

None at this time.

SI: Performance Improvements for Larger Blogs

Sponsorship

If this request requires additional support (e.g., such as direct email/phone/meeting/development), I have the following interest in helping to sponsor the effort via GitHub Sponsors:

  • None, please continue to work for me for free :P
  • Absolutely, I get value out of this!
  • Maybe later
  • I'm already a sponsor... Woot!

Is your feature request related to a problem?

Where there are a lot of blogs in HubSpot, there are possible timeouts that the API will present, causing the import/export process to only partially complete. There needs to be a more flexible implementation to account for this.

Describe the solution you'd like

Create a table to keep track of the blog posts that are imported. Subsequent imports should look at this database and ignore any posts that have already been migrated.

Implement an asynchronous routine that will look for and import 20 blog posts at a time. Each batch should be logged and/or tracked, as specified here.

All steps should have thorough log reporting. Ideally, to the Log4NET file.

Describe alternatives you've considered

None at this time.

Additional context

None at this time.

DotNetNuke.Web-9.8.0.0.dll: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - DotNetNuke.Web-9.8.0.0.dll

DotNetNuke.Web

Library home page: https://api.nuget.org/packages/dotnetnuke.web.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.Web.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (DotNetNuke.Web version) Remediation Possible**
CVE-2021-40186 High 7.5 DotNetNuke.Web-9.8.0.0.dll Direct DotNetNuke.Web - 9.11.0;DotNetNuke.Core - 9.11.0 โŒ
CVE-2022-2922 Medium 4.9 DotNetNuke.Web-9.8.0.0.dll Direct DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-40186

Vulnerable Library - DotNetNuke.Web-9.8.0.0.dll

DotNetNuke.Web

Library home page: https://api.nuget.org/packages/dotnetnuke.web.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.Web.dll

Dependency Hierarchy:

  • โŒ DotNetNuke.Web-9.8.0.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the firewall and access sensitive information from Cloud Provider metadata services.

Publish Date: 2022-06-02

URL: CVE-2021-40186

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-40186

Release Date: 2022-06-02

Fix Resolution: DotNetNuke.Web - 9.11.0;DotNetNuke.Core - 9.11.0

Step up your Open Source Security Game with Mend here

CVE-2022-2922

Vulnerable Library - DotNetNuke.Web-9.8.0.0.dll

DotNetNuke.Web

Library home page: https://api.nuget.org/packages/dotnetnuke.web.9.8.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/DotNetNuke.Web.dll

Dependency Hierarchy:

  • โŒ DotNetNuke.Web-9.8.0.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

Publish Date: 2022-09-30

URL: CVE-2022-2922

CVSS 3 Score Details (4.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9w72-2f23-57gm

Release Date: 2022-09-30

Fix Resolution: DotNetNuke.Core - 9.11.0, DotNetNuke.Web - 9.11.0

Step up your Open Source Security Game with Mend here

log4net-1.2.10.0.dll: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - log4net-1.2.10.0.dll

log4net for .NET Framework 2.0

Library home page: https://api.nuget.org/packages/log4net.1.2.10.nupkg

Path to vulnerable library: /References/HotcakesCommerce/03.06.00/log4net.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (log4net version) Remediation Possible**
CVE-2018-1285 Critical 9.8 log4net-1.2.10.0.dll Direct log4net - 2.0.10 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-1285

Vulnerable Library - log4net-1.2.10.0.dll

log4net for .NET Framework 2.0

Library home page: https://api.nuget.org/packages/log4net.1.2.10.nupkg

Path to vulnerable library: /References/HotcakesCommerce/03.06.00/log4net.dll

Dependency Hierarchy:

  • โŒ log4net-1.2.10.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Publish Date: 2020-05-11

URL: CVE-2018-1285

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-05-11

Fix Resolution: log4net - 2.0.10

Step up your Open Source Security Game with Mend here

LiteDB-3.1.0.0.dll: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - LiteDB-3.1.0.0.dll

LiteDB

Library home page: https://api.nuget.org/packages/litedb.3.1.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/LiteDB.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (LiteDB version) Remediation Possible**
CVE-2022-23535 Critical 9.8 LiteDB-3.1.0.0.dll Direct LiteDB - 5.0.13 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23535

Vulnerable Library - LiteDB-3.1.0.0.dll

LiteDB

Library home page: https://api.nuget.org/packages/litedb.3.1.0.nupkg

Path to vulnerable library: /References/DNN/09.08.00/LiteDB.dll

Dependency Hierarchy:

  • โŒ LiteDB-3.1.0.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from BsonDocument to POCO classes. When instances of an object are not the same of class, BsonMapper use a special field _type string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using Object type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.

Publish Date: 2023-02-24

URL: CVE-2022-23535

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23535

Release Date: 2023-02-24

Fix Resolution: LiteDB - 5.0.13

Step up your Open Source Security Game with Mend here

System.Web.Mvc-5.1.20821.0.dll: 1 vulnerabilities (highest severity is: 3.7)

Vulnerable Library - System.Web.Mvc-5.1.20821.0.dll

System.Web.Mvc.dll

Library home page: https://api.nuget.org/packages/microsoft.aspnet.mvc.5.1.3.nupkg

Path to vulnerable library: /References/DNN/09.08.00/System.Web.Mvc.dll

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (System.Web.Mvc version) Remediation Possible**
CVE-2014-4075 Low 3.7 System.Web.Mvc-5.1.20821.0.dll Direct Microsoft.AspNet.Mvc - 3.0.50813.1 ,4.0.40804.0 ,5.0.2, 5.1.3 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2014-4075

Vulnerable Library - System.Web.Mvc-5.1.20821.0.dll

System.Web.Mvc.dll

Library home page: https://api.nuget.org/packages/microsoft.aspnet.mvc.5.1.3.nupkg

Path to vulnerable library: /References/DNN/09.08.00/System.Web.Mvc.dll

Dependency Hierarchy:

  • โŒ System.Web.Mvc-5.1.20821.0.dll (Vulnerable Library)

Found in HEAD commit: d282ae557ccbdfd8ee31cb43a3774b95dc23f026

Found in base branch: main

Vulnerability Details

Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability."

Publish Date: 2014-10-15

URL: CVE-2014-4075

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-059#mvc-xss-vulnerability---cve-2014-4075

Release Date: 2014-10-15

Fix Resolution: Microsoft.AspNet.Mvc - 3.0.50813.1 ,4.0.40804.0 ,5.0.2, 5.1.3

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.