MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if...

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if an...

ASP.NET Core HTTP Header Injection Vulnerability

ASP.NET Core is a new open source and cross-platform framework for building modern cloud-based applications connected to the Internet such as web applications, Internet of Things IoT applications, and mobile back-end applications. An HTTP header injection vulnerability exists in ASP.NET Core...

ASP.NET Core 5-RC1 HTTP Header Injection Vulnerability

ASP.NET Core version 5.-RC1 suffers from an HTTP header injection vulnerability. Product: ASP.NET Core Vendor: Microsoft https://www.microsoft.com CSNC ID: CSNC-2016-006 Subject: HTTP Header Injection Risk: Medium Effect: HTTP Header manipulation Author: Reto Schadler email protected Date:...

ASP.NET Core 5-RC1 HTTP Header Injection

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: ASP.NET Core Vendor: Microsoft https://www.microsoft.com CSNC ID: CSNC-2016-006 Subject: HTTP Header Injection Risk: Medium Effect: HTTP Header manipulation Author: Reto Schadler [email protected] Dat...

yawast - The YAWAST Antecedent Web Application Security Toolkit

YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL - Versions and cipher suites supported; common issues. Information Disclosure - Checks for common information...

Multiple Elevation of Privilege Vulnerabilities in Microsoft ASP.NET Core MVC

Microsoft ASP.NET, part of .NET FrameWork, is a Microsoft technology that is a server-side scripting technology that enables scripts embedded in Web pages to be executed by Internet servers. Multiple elevation of privilege vulnerabilities exist in Microsoft ASP.NET Core MVC. An attacker can explo...

Microsoft ASP.NET Core MVC Multiple Privilege Escalation Vulnerabilities

Description Microsoft ASP.NET Core MVC is prone to multiple privilege escalation vulnerabilities. Attackers can exploit these issues to gain elevated privileges. Microsoft ASP.NET Core MVC 1.0.0 is vulnerable. Technologies Affected Microsoft ASP.NET Core MVC 1.0.0 Recommendations Block external...

Microsoft Adds .NET Core, ASP.NET to Bug Bounty Program

Microsoft is stepping up its bug hunting efforts surrounding its Visual Studio development suite, adding Microsoft .NET Core and ASP.NET Core to its Bug Bounty program. The bounties opened yesterday and will run “indefinitely,” according to Microsoft. The bounty program includes the Windows and...

Announcing a Microsoft .NET Core and ASP.NET Core Bug Bounty

It’s our pleasure to announce another exciting expansion of the Microsoft Bounty Programs. Today, we will be adding .NET Core and ASP.NET Core to our suite of ongoing bounty programs. We are offering a bounty on the Windows and Linux versions of .NET Core and ASP.NET Core starting on September 1,...

CIMA DocuClass ECM - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: CIMA DocuClass Enterprise Content Management - Multiple Vulnerabilities Date: July 15, 2016 Exploit Author: Karn Ganeshen ipositivesecurity.blogspot.com Vendor Homepage: cima-software.com Version: app version All Tested on:...

http-aspnet-debug NSE Script

Determines if a ASP.NET application has debugging enabled using a HTTP DEBUG request. The HTTP DEBUG verb is used within ASP.NET applications to start/stop remote debugging sessions. The script sends a 'stop-debug' command to determine the application's current configuration state but access to R...

Microsoft Bounty Program expansion - .NET Core and ASP.NET RC2 Beta Bounty

Today I have another exciting expansion of the Microsoft Bounty Program. Please visit https://aka.ms/BugBounty to find out more. As we approach release for .NET Core and ASP.NET, we would like to get even more feedback from the security research community. We are offering a bounty on the .NET Cor...

AfterLogic WebMail Pro ASP.NET Account Takeover / XXE Injection

No description provided by source...

AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection

AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure via XML External Entity Injection 1. ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro...

AfterLogic WebMail Pro ASP.NET 6.2.6 - Administrator Account Disclosure (via XXE Injection)

Exploit for asp platform in category web applications 1. ADVISORY INFORMATION ======================================== Title: AfterLogic WebMail Pro ASP.NET Administrator Account Takover via XXE Injection Application: AfterLogic WebMail Pro ASP.NET Class: Sensitive Information disclosure Remotely...

ShopNum1 ProductListCategory.aspx文件BrandGuid参数SQL注入漏洞

0x01 框架介绍 ShopNum1网店系统是武汉群翔软件有限公司自主研发的基于 WEB 应用的 B/S 架构的B2C网上商店系统，主要面向中高端客户， 为企业和大中型网商打造优秀的电子商务平台，ShopNum1运行于微软公司的 .NET 平台，采用最新的 ASP.NET 3.5技术进行分层开发。拥有更强的安全性、稳定性、易用性。 官方主页：www.shopnum1.com 影响厂商：武汉群翔软件有限公司 0x02 漏洞利用 关键词：inurl:ProductListCategory.aspx BrandGuid参数过滤不严导致注入。 利用方式：...

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities Vendor: Infor Product web page: http://www.infor.com Affected version: 8.2.0.1136 Summary: Infor® CRM, formerly Saleslogix, is an award-winning customer...

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities

Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities Vendor: Infor Product web page: http://www.infor.com Affected version: 8.2.0.1136 Summary: Infor® CRM, formerly Saleslogix, is an award-winning customer relationship management CRM solution that provides a complete view of...

Infor CRM 8.2.0.1136 - Multiple HTML Script Injection Vulnerabilities

Exploit for multiple platform in category web applications Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities Vendor: Infor Product web page: http://www.infor.com Affected version: 8.2.0.1136 Summary: Infor® CRM, formerly Saleslogix, is an award-winning customer relationship...