2278 matches found
August 11, 2020-KB4569746 Cumulative Update for .NET Framework 4.8 for Windows 10 version 1607 and Windows Server 2016
None None...
KLA11934 Multiple vulnerabilities in Microsoft Developer Tools
Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in ASP.NET Core can be exploit...
RHEL 7 : .NET Core 3.1 security and bugfix update for Red Hat Enterprise Linux (Important) (RHSA-2020:3421)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3421 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...
August 11, 2020-KB4569747 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1703
None None...
Security Update for Microsoft ASP.NET Core (DoS) (August 2020)
The Microsoft ASP.NET Core installation on the remote host is version 2.1.x 2.1.21, or 3.1.x 3.1.7. It is, therefore, affected by a denial of service DoS vulnerability when ASP.NET Core improperly handles web requests. An unauthenticated, remote attacker can exploit this issue, via sending a...
Security Updates for Microsoft Visual Studio Products (August 2020)
The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by a denial-of-service vulnerability: - A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a...
CVE-2020-1147
It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core...
Credit-Card Skimmer Has Unlikely Target: Microsoft ASP.NET Sites
Researchers have identified a credit-card skimming campaign that’s been active since mid-April that has a rather specific and unusual target: ASP.NET-based websites running on Microsoft Internet Information Services IIS servers. New research from Malwarebytes Labs recently uncovered the campaign,...
Credit card skimmer targets ASP.NET sites
Update: 2020-07-09 A reader contacted us with information about this series of attacks on .NET sites. There is a known vulnerability CVE-2017-9248 for Telerik UI for ASP.NET that is being exploited. An attacker can upload .aspx web shells and get remote code execution. This Telerik page offers...
Spoofable Cookies
Microsoft asp.net has caused spoofable cookies. It does not properly encode the data string parsed to cookie name value, allowing an attacker who can perform a secondary exploit such as an XSS vulnerability in the web site to inject the spoofed cookies if the prefixes are used...
Telerik UI for ASP.NET AJAX RadAsyncUpload Multiple Vulnerabilities
According to its self-reported version number, the version of Telerik UI for ASP.NET AJAX is affected by multiple vulnerabilities in Telerik.Web.UI.dll : - An insecure direct object reference vulnerability due to user input used directly by RadAsyncUpload without modification or validation...
Telerik UI for ASP.NET AJAX RadAsyncUpload .NET Deserialization Vulnerability
According to its self-reported version number, the version of Telerik UI for ASP.NET AJAX prior to 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or...
Telerik UI for ASP.NET AJAX Cryptographic Weakness
According to its self-reported version number, the version of Telerik UI for ASP.NET is affected by a cryptographic weakness. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...
Lansweeper 7.2 Default Account / Remote Code Execution Vulnerability
Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE : CVE-2020-14011 Title...
Lansweeper 7.2 Default Account / Remote Code Execution
Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...
Lansweeper 7.2 - Incorrect Access Control
Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...
VulnCheck KEV: CVE-2017-11317
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code...
Microsoft SharePoint Server Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security conte...
CVE-2020-1181: Undefined Security Weakness
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'...
