Directory traversal

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. dot dot in the EVENTARGUMENT parameter...

CVE-2014-2575

Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. dot dot in the EVENTARGUMENT parameter...

CVE-2014-2575

The CVE-2014-2575 entry concerns DevExpress ASPxFileManager for WebForms and MVC. A directory traversal vulnerability allows remote authenticated users to read or write arbitrary files by supplying a relative path in __EVENTARGUMENT, affecting DevExpress ASPxFileManager versions up to 13.2.8 (and...

DevExpress ASP.NET File Manager 13.2.8 Directory Traversal

DevExpress ASP.NET File Manager versions 10.2 through 13.2.8 suffer from a directory traversal vulnerability. Directory Traversal in DevExpress ASP.NET File Manager During a penetration test RedTeam Pentesting discovered a directory traversal vulnerability in DevExpress' ASP.NET File Manager and...

DevExpress ASP.NET File Manager 13.2.8 Directory Traversal

Advisory: Directory Traversal in DevExpress ASP.NET File Manager During a penetration test RedTeam Pentesting discovered a directory traversal vulnerability in DevExpress' ASP.NET File Manager and File Upload. Attackers are able to read arbitrary files by specifying a relative path. Details =====...

Acunetix Web Vulnerability Scanner Version 9 - Web Application Security Testing Tool

Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...

Jira appears to disclose unprocessed server tags in the output of the Marketplace plugin

As discovered/reported by running a security scan with the Acunetix web vulnerability scanner on our internally hosted instance of Jira, the Marketplace plugin appears to disclose ASP.NET style server tags in the output HTML. For example, appears in the HTML for the following page:...

Jira appears to disclose unprocessed server tags in the output of the Marketplace plugin

As discovered/reported by running a security scan with the Acunetix web vulnerability scanner on our internally hosted instance of Jira, the Marketplace plugin appears to disclose ASP.NET style server tags in the output HTML. For example, appears in the HTML for the following page:...

Microsoft ASP.NET POST Request Denial of Service (MS14-009; CVE-2014-0253)

A denial of service vulnerability exists in Microsoft ASP.NET. The vulnerability is caused when the .NET Framework improperly identifies stale or closed HTTP client connections. A remote attacker can trigger this flaw by sending a small number of specially crafted requests to an affected server...

Netvolution WCM CMS 3 SQL Injection

Exploit Title: Netvolution WCM - CMS v3 SQL Injection Exploit Type: Error-based SQL injection Date: Sun 02 Mar 2014 Exploit Author: projectzero labs Projectzero ID: projectzero2014-002-netvolutionsqli Vendor Homepage: http://www.netvolution.net && http://www.atcom.gr Version: 3 as vendor comfirme...

CVE-2014-0253

CVE-2014-0253 affects multiple .NET Framework versions (1.1 SP1, 2.0 SP2, 3.5/3.5.1, 4, 4.5, 4.5.1). The issue is improper handling of TCP connection states, allowing a remote attacker to cause a denial of service by sending crafted HTTP requests that trigger persistent resource consumption, resu...

Microsoft .NET Framework 远程拒绝服务漏洞(CVE-2014-0253)(MS14-009)

BUGTRAQ ID: 65415 CVECAN ID: CVE-2014-0253 .NET就是微软的用来实现XML，Web Services，SOA（面向服务的体系结构service-oriented architecture）和敏捷性的技术。.NET Framework是微软开发的软件框架，主要运行在Microsoft Windows上。 Microsoft ASP.NET中存在拒绝服务漏洞，可使攻击者造成ASP.NET服务器不响应。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET...

Microsoft .NET Framework Multiple Vulnerabilities (2916607)

This host is missing an important security update according to Microsoft Bulletin MS14-009. OpenVAS Vulnerability Test $Id: secpodms14-009.nasl 7582 2017-10-26 11:56:51Z cfischer $ Microsoft .NET Framework Multiple Vulnerabilities 2916607 Authors: Thanga Prakash S Copyright: Copyright C 2014...

Microsoft .NET Framework Multiple Vulnerabilities (2916607)

This host is missing an important security update according to Microsoft Bulletin MS14-009. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SmarterMail Email正文HTML注入漏洞

Bugtraq ID:64970 SmarterMail是一款邮件服务程序。 SmarterMail不正确过滤Email正文数据，允许远程攻击者利用漏洞构建恶意邮件，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 SmarterMail 11.x 目前没有详细解决方案提供： http://www.smartertools.com/smartermail/mail-server-software.aspx ?php / Exploit Title: SmarterMail Enterprise and Standard =11.x Stored XSS Google...

BlogEngine.NET 'sioc.axd'信息泄露漏洞

BUGTRAQ ID: 64635 CVECAN ID: CVE-2013-6953 BlogEngine.NET是轻量级ASP.NET博客平台。 BlogEngine.NET 2.8.0.0及更早版本在实现上存在信息泄露漏洞，这可使未经身份验证的用户查看BlogEngine.net站点的用户名和哈希密码。 0 BlogEngine.NET BlogEngine.NET 2.0 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dotnetblogengine.net/...

Microsoft ASP.NET Insecure Site Configuration Vulnerability (2905247)

This host is missing an important security update according to Microsoft advisory 2905247. OpenVAS Vulnerability Test $Id: gbmicrosoftsecurityadvisory2905247.nasl 6086 2017-05-09 09:03:30Z teissa $ Microsoft ASP.NET Insecure Site Configuration Vulnerability 2905247 Authors: Thanga Prakash S...

Microsoft ASP.NET Insecure Site Configuration Vulnerability (2905247)

This host is missing an important security update according to Microsoft advisory 2905247. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2013-5042

Cross-site scripting XSS vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS...