Multiple HTTP Error Responses (CVE-2010-3332)

ASP.NET is a collection of technologies within the.NET Framework that enable developers to build Web applications and XML Web Services. A remote attacker may exploit this issue to read data, such as the View State, which was encrypted by the server. This vulnerability is caused by ASP.NET providi...

On Stuxnet, the ASP.NET Vulnerability and the Return of Unofficial Patches

Threatpost editors Dennis Fisher and Paul Roberts talk about the revelation that Stuxnet included four previously unknown flaws, the padding oracle attack on ASP.NET Web apps and the return of unofficial patches for zero days. audio http://www.threatpost.com/sites/default/files/newswrap23.mp3...

Demo of ASP.NET Padding Oracle Attack

In this video, researchers Juliano Rizzo and Thai Duong demonstrate the technique they developed for stealing cryptographic keys for ASP.NET Web applications, enabling them to compromise virtually any app built on ASP.NET. You can read the full story of their attack in this article, “Padding Orac...

Week in Review: Web Insecurity and Fixes for Stuxnet

Web insecurity was in the news this week, with a major flaw in the security of ASP.NET and some sobering statistics on Web site infections. When your bank account gets hacked – is it your fault? And, with a patch out for one of four ! zero day exploits used by Stuxnet, security experts wonder if...

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say...

online product / shop online (productdetail.cfm) SQL Injection

Exploit for asp platform in category web applications ============================================================== online product / shop online productdetail.cfm SQL Injection ============================================================== + Category : vurnerebility SQLI online product + Running...

Rapid7 Security Advisory 36

R7-0036: FCKEditor.NET File Upload Code Execution August 30, 2010 -- Vulnerability Details: FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP code via the ASP.NET connector in FCKEditor. The vulnerability requires that the remote...

BugTracker.NET 3.4.3 SQL Injection

BugTracker.net 3.4.3 SQL Injection Name BugTracker.NET Vendor http://www.ifdefined.com/www/ Versions Affected 3.4.4 when custom fields are used Author Mark van Tilburg Website http://markvt.info Contact markvantilburg at gmail dot com Date 2010-08-22 X. INDEX I. ABOUT THE APPLICATION II...

CVE-2010-1898

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

CVE-2010-1898

CVE-2010-1898 is a remote code execution vulnerability in the Microsoft .NET CLR handling delegates to virtual methods, affecting CLR-based apps and Silverlight. The issue enables arbitrary code execution via three attack scenarios: XBAPs (XAML browser applications), ASP.NET pages, or standalone ...

CVE-2010-1898

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

Microsoft Security Bulletin MS10-060 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (2265906)

Microsoft Security Bulletin MS10-060 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution 2265906 Published: August 10, 2010 Version: 1.0 General Information Executive Summary This security update resolves two...

Fedora Update for xsp FEDORA-2010-10332

Check for the Version of xsp OpenVAS Vulnerability Test Fedora Update for xsp FEDORA-2010-10332 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora Update for mod_mono FEDORA-2010-10332

Check for the Version of modmono OpenVAS Vulnerability Test Fedora Update for modmono FEDORA-2010-10332 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] Fedora 13 Update: xsp-2.6.4-1.fc13

XSP is a standalone web server written in C that can be used to run ASP.NET applications as well as a set of pages, controls and web services that you can use to experience ASP.NET...

[SECURITY] Fedora 13 Update: mod_mono-2.6.3-1.fc13

modmono allows Apache to serve ASP.NET pages by proxying the requests to a slightly modified version of the XSP server, called mod-mono-server, that is installed along with XSP...

DorsaCMS Remote File Upload Vulnerability

Exploit for php platform in category web applications ========================================= DorsaCMS Remote File Upload Vulnerability ========================================= By : NetQurd SPT : d3c0der , HIV Security Team Mail : email protected , email protected Web : Http://AttackerZ.iR Hom...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...