CVE-2010-2085

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting XSS attacks via the VIEWSTATE parameter...

CVE-2010-1459

CVE-2010-1459 concerns Mono’s ASP.NET implementation where the default EnableViewStateMac setting was FALSE prior to version 2.6.4, enabling remote attackers to conduct XSS via the __VIEWSTATE parameter (e.g., in XSP sample project). The initial description confirms the XSS vector and affected co...

CVE-2010-1459

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by the VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project...

CVE-2010-2088

CVE-2010-2088 : The connected sources confirm a cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 3.5’s ASP.NET where an unencrypted __VIEWSTATE is not properly handled. This allows remote attackers to inject script via the ViewState parameter. Affected product/component: Micro...

CVE-2010-2088

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting XSS attacks against the form control via the VIEWSTATE parameter...

CVE-2010-2084

CVE-2010-2084 affects Microsoft ASP.NET 2.0. The vulnerability arises because InnerHtml can be set on controls inheriting from HtmlContainerControl, enabling remote XSS via attribute-related vectors. Documented impacts are limited to XSS; no exploit or patch/version details are provided in the su...

CVE-2010-1459

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by the VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project...

HostFriendz.com SQL Injection

+===============================================================================+ + Copyright 2008 HostFriendz.com & SQL INJECTION + +===============================================================================+ Authors: Ivan Sanchez Product: Copyright 2008 HostFriendz Web: http://hostnomi.net...

Blaze Apps Multiple Vulnerabilities

Exploit for asp platform in category web applications =================================== Blaze Apps Multiple Vulnerabilities =================================== Title: Blaze Apps Multiple Vulnerabilities Vendor: http://blazeapps.codeplex.com Vulnerable Version: 1.4.0.051909 and prior versions...

Flash Tag Cloud Control Cross Site Scripting

Hello Bugtraq! I want to warn you about security vulnerability in Flash Tag Cloud control for ASP.NET. ----------------------------- Advisory: Vulnerability in widget Flash Tag Cloud for Blogsa and other ASP.NET engines ----------------------------- URL: http://websecurity.com.ua/4213/...

Bitrac personal blog system upload vulnerability-vulnerability warning-the black bar safety net

Bitrac the official version, Bitrac is based on ASP.NET 2.0 + SQLite for single-user blogging application, built-in URLRewrite and page compression, supports the MetaWeblogAPI, the self-write the HTML template engine, easy to modify style, full visual editing environment. The current vendors have...

Bitrac 1.25.0.2500个人博客系统上传漏洞

Bitrac 正式版本，Bitrac 是基于 ASP.NET 2.0 + SQLite 的单用户博客程序，内置 URLRewrite 和页面压缩功能，支持 MetaWeblogAPI，自写的 HTML 模板引擎，方便修改风格，完全的可视化编辑环境。 首先说一下Bitrac在线升级顺序。 在后台请求 升级 Control.ashx Automat string sCode = SiteFun.RandomStr9; AdmStat.SetLockFilesCode; 在网站Errors目录随机生成一个.lock 文件,同时文件名记录在 Autoset.Cookie + "Lock"...

DOURAN Smart Portal V1.7.0.0 remote file upload Vulnerability

Exploit for asp platform in category web applications ============================================================= DOURAN Smart Portal V1.7.0.0 remote file upload Vulnerability ============================================================= Exploit Title: DOURAN Smart Portal remote file uploade...

Citrix Web Interface源码信息泄露漏洞

BUGTRAQ ID: 38838 Citrix Web Interface是Citrix Presentation Server上使用的免费附件组件，允许用户使用浏览器连接到应用。 Citrix Web Interface的ClientScripts文件夹中的JavaScript文件包含有ASP.NET代码，Citrix ASPX文件会引用这些文件用于解析JS文件中的ASP.NET内容，解析后所生成的JavaScript内容在浏览器中ASPX页面显示。...

Microsoft ASP.NET ViewState Denial of Service (CVE-2005-1665)

ASP.NET is a technology that provides a programming model and infrastructure for creating dynamic web applications. ASP.NET is part of the Microsoft .NET Framework. ASP.NET is deployed on Microsoft Internet Information Server, which treats files with the .aspx extension as ASP.NET files and passe...

CVE-2009-4665

Directory traversal vulnerability in CuteSoftClient/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Directory traversal

Directory traversal vulnerability in CuteSoftClient/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2009-4665

Directory traversal vulnerability in CuteSoftClient/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2009-4665

CVE-2009-4665 affects CuteSoft Components Cute Editor for ASP.NET. Affected component: CuteSoft_Client/CuteEditor/Load.ashx. Vulnerability type: directory traversal via the file parameter using a .. payload, enabling reading of arbitrary files. Base CVSS v2 score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) ...

Trustwave's SpiderLabs Security Advisory TWSL2010-001

Trustwave's SpiderLabs Security Advisory TWSL2010-001: Multiplatform View State Tampering Vulnerabilities Published: 2010-02-08 Version: 1.1 SpiderLabs has documented view state tampering vulnerabilities in three products from separate vendors. View states are used by some web application...