Fedora Core 6 : mono-1.1.17.1-4.fc6 (2007-067)

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. After upgrading the packages you need to...

Fedora Core 5 : mono-1.1.13.7-3.fc5.1 (2007-068)

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. After upgrading the packages you need to...

instant-xss.txt

InstantForum.NET Multiple Cross-Site Scripting Vulnerability ASP.NET based discussion forum. Full administration, WYSIWYG editor, Permission based forum access, Assign forum moderators, VS.NET solution available. InstantForum.NET is the most comprehensive, high performance ASP.NET & SQL Server...

Mono: Information disclosure

Background Mono provides the necessary software to develop and run .NET client and server applications on various platforms. Description Jose Ramon Palanco has discovered that the System.Web class in the XSP for the ASP.NET server 1.1 through 2.0 in Mono does not properly validate or sanitize loc...

Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scrip...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

CVE-2006-6104 affects the Mono platform’s XSP/ASP.NET server. The System.Web class does not properly verify local pathnames, allowing remote attackers to read sensitive content: source code by appending a space to a URI, and Web.Config via a Web.Config%20 request. The vulnerability lies in Mono 1...

Microsoft ASP.NET AutoPostBack变量跨站脚本漏洞（MS06-056）

ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 ASP.Net Framework 2.0的服务器中存在一个跨站点脚本执行漏洞，可能在用户的浏览器中注入客户端脚本，该脚本可能欺骗内容、泄露信息或执行用户可以在受影响的网站上执行的任何操作。要试图利用此漏洞，需要进行用户交互。 Microsoft ASP.NET 2.0 Microsoft已经为此发布了一个安全公告（MS06-056）以及相应补丁: MS06-056：Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure 922770...

Microsoft Security Bulletin MS06-056 Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure (922770)

Microsoft Security Bulletin MS06-056 Vulnerability in ASP.NET 2.0 Could Allow Information Disclosure 922770 Published: October 10, 2006 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows .NET Framework 2.0 Impact of Vulnerability: Information Disclosure Maximu...

ASP.NET crossite scripting

Crossite scripting with AutoPostBack forms...

CVE-2006-3436

Cross-site scripting XSS vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true"...

CVE-2006-3436

Cross-site scripting XSS vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true"...

Microsoft ASP.NET AutoPostBack Variable Cross-Site Scripting Vulnerability

Description Microsoft ASP.NET is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input before it is rendered in the browser of an unsuspecting user in the context of the affected site. An attacker may leverage this issue to have arbitrar...

MS06-056: Vulnerabilities in ASP.NET could allow information disclosure (922770)

The remote host is running a version of the ASP.NET framework that contains a cross-site scripting vulnerability that could allow an attacker to execute arbitrary code in the browser of the users visiting the remote website. C Tenable Network Security, Inc. include"compat.inc"; if description...

Update Protection against ASP.NET Information Disclosure Vulnerability (MS06-033)

ASP.NET is collection of technologies within the.NET Framework that enable developers to build Web applications and XML Web Services. An information disclosure vulnerability exists in ASP.Net that could allow an attacker to bypass ASP.Net security and gain unauthorized access to objects in the...

CVE-2006-1300

Microsoft .NET framework 2.0 ASP.NET in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."...