CVE-2021-28141

An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the...

Indiscriminate Exploitation of Microsoft Exchange Servers (CVE-2021-24085)

The following blog post was co-authored by Andrew Christian and Brendan Watters. Beginning Feb. 27, 2021, Rapid7’s Managed Detection and Response MDR team has observed a notable increase in the automated exploitation of vulnerable Microsoft Exchange servers to upload a webshell granting attackers...

Command Execution Vulnerability in XYCMS

XYCMS studio training structure source code is a training organization website source code developed in asp access. XYCMS has a command execution vulnerability that can be exploited by an attacker to gain control of the server...

XYCMS message board has a logic flaw vulnerability

XYCMS message board is to asp access for the development of asp message board source code. XYCMS message board has a logic flaw vulnerability, attackers can use this vulnerability to carry out unlimited number of brute-force attacks...

XYCMS suffers from SQL injection vulnerability (CNVD-2021-17386)

XYCMS is an enterprise building system developed with asp+access. XYCMS has a SQL injection vulnerability, which can be exploited by attackers to obtain database information...

SQL injection vulnerability in the ca***.asp page of the website building system of Ningbo Yilong Computer Technology Co.

Ningbo YiLong Computer Technology Co., Ltd. is a design and build enterprise focusing on enterprise website platform, government school, home service and other industries. There is a SQL injection vulnerability in the ca.asp page of the website builder system of Ningbo Yilong Computer Technology ...

ZZCMS has a flawed logic vulnerability

ZZCMS is a completely open source based on PHP, ASP's product investment website management system , project investment website management system , enterprise website management system . ZZCMS there exists a logic flaw vulnerability. Attackers can use the vulnerability to reinstall the system...

dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2

A flaw was found in dotnet. Running callbacks outside of locks results in Krestel deadlock using HTTP2. The highest threat from this vulnerability is to system availability...

PT-2021-1575 · Microsoft +3 · Visual Studio +5

Name of the Vulnerable Software and Affected Versions: ASP.NET Core and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation in ASP.NET Core and Visual Studio, which can lead to a denial-of-service condition. This can be exploited by a...

CVE-2020-24903

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting XSS caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the...

XSS Vulnerability in Kaixin Worklog System worklog

Kaixin Worklog Worklog system is a software system based on B/S to build the collaborative office within the enterprise. The system uses ASP.NET language development. Kai star worklog system worklog there are XSS vulnerabilities , attackers can use the vulnerability to obtain sensitive informatio...

FlexDotnetCMS 1.5.8 Arbitrary ASP File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FlexDotnetCMS Arbitrary ASP File Upload', 'Description' = %q This module exploits an arbitrary file upload vulnerability in FlexDotnetCMS v1.5.8...

CVE-2020-27386

An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code e.g., ASP code in the form of a safe file type e.g., a TXT file, and then using the FileEditor in v1.5.8...

October 1, 2020-KB4576945 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10, version 2004 and Windows Server, version 2004

None None...

FlexDotnetCMS Arbitrary ASP File Upload

This module exploits an arbitrary file upload vulnerability in FlexDotnetCMS v1.5.8 and prior in order to execute arbitrary commands with elevated privileges. The module first tries to authenticate to FlexDotnetCMS via an HTTP POST request to /login. It then attempts to upload a random TXT file a...

CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

Microsoft .NET Core and ASP.NET Core Security Feature Bypass Vulnerability

Microsoft .NET Core and Microsoft ASP.NET Core are both products of Microsoft Corporation USA. NET Core is a free open source development platform. NET Core is a free open source development platform with multi-language support and cross-platform features.Microsoft ASP.NET Core is a framework of...

Microsoft SharePoint Server 2019 < 16.0.10366.12106 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to...

SQL injection vulnerability in the ne***.asp page of the website building system of Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is a high-tech Internet technology service provider. Hanzhong Qiyuan Power Network Co., Ltd. station-building system ne.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in the ne***_vi***.asp page of the website building system of Wenzhou Qiaoyu Technology Co.

Wenzhou Qiaoyu Technology Co., Ltd. is an enterprise focusing on network marketing integration services. Wenzhou Qiaoyu Technology Co., Ltd. station-building system nevi.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...