CVE-2017-0247

The CVE affects Microsoft ASP.NET Core: a DoS vulnerability caused by improper validation of web requests in the TextEncoder.EncodeCore function. It applies to ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3, where remote attackers could trigger DoS by exploiting incorrect calculation of the...

CVE-2017-0249

CVE-2017-0249 affects Microsoft ASP.NET Core. A vulnerability in which ASP.NET Core fails to properly sanitize web requests could allow elevation of privileges. Reported CVSS v3 base score 7.3 (HIGH) with NETWORK attack vector, LOW confidentiality/integrity/availability impact. Connected IBM bull...

CVE-2017-0256

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests...

U.S. Dept Of Defense: Two Error-Based SQLi in courses.aspx on ██████████

Summary: The server at ████ contains two SQL injection vulnerabilities in the courses.aspx file. These are error-based SQLi vulnerabilities. The resulting errors reveal seven lines of C code, including inline SQL which reveals internal database information. Note that this is one of two reports I'...

Crypttech CryptoLog Remote Code Execution

This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog. An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities are no longer present in the ASP.NET version CryptoLog, available since 2009...

Microsoft Fixes 45 Vulnerabilities with new Security Update Guide – says goodbye to Security Bulletins

Today is the first month since 1998 in which Microsoft stopped releasing security bulletins with the familiar MSxx-xxx format and replaced it with the new security update guide. We talked about this change earlier in a few blog posts and finally today it’s time to say good bye to security bulleti...

Invoice Template - 'hash' SQL Injection

Exploit Title: Invoice Template v1.0 for PHPRunner/ASPRunnerPro/ASPRunner.NET. - SQL Injection Google Dork: N/A Date: 07.04.2017 Vendor Homepage: https://xlinesoft.com/ Software: https://xlinesoft.com/invoice Demo: https://xlinesoft.com/livedemo/invoice/livedemo1/ Version: 1.0 Tested on: Win7 x64...

Description of the security update for the .NET Framework 4 on Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: December 10, 2013

Description of the security update for the .NET Framework 4 on Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: December 10, 2013 September 9, 2014 This security update has been re-released and contains updated files. We recommend that you apply this...

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if...

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if...

MS14-053: Description of the security update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that...

Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: December 10, 2013

Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: December 10, 2013 September 9, 2014 This security update has been released on Windows Update. View products that this article applies to. Introduction This securi...

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if an...

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that could allow denial of service if an...

MS14-053: Description of the security update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: September 9, 2014

MS14-053: Description of the security update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: September 9, 2014 View products that this article applies to. Introduction This update resolves a vulnerability in the Microsoft .NET Framework that...

ASP.NET Core HTTP Header Injection Vulnerability

ASP.NET Core is a new open source and cross-platform framework for building modern cloud-based applications connected to the Internet such as web applications, Internet of Things IoT applications, and mobile back-end applications. An HTTP header injection vulnerability exists in ASP.NET Core...

ASP.NET Core 5-RC1 HTTP Header Injection

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: ASP.NET Core Vendor: Microsoft https://www.microsoft.com CSNC ID: CSNC-2016-006 Subject: HTTP Header Injection Risk: Medium Effect: HTTP Header manipulation Author: Reto Schadler [email protected] Dat...

ASP.NET Core 5-RC1 HTTP Header Injection Vulnerability

ASP.NET Core version 5.-RC1 suffers from an HTTP header injection vulnerability. Product: ASP.NET Core Vendor: Microsoft https://www.microsoft.com CSNC ID: CSNC-2016-006 Subject: HTTP Header Injection Risk: Medium Effect: HTTP Header manipulation Author: Reto Schadler email protected Date:...

yawast - The YAWAST Antecedent Web Application Security Toolkit

YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL - Versions and cipher suites supported; common issues. Information Disclosure - Checks for common information...

Multiple Elevation of Privilege Vulnerabilities in Microsoft ASP.NET Core MVC

Microsoft ASP.NET, part of .NET FrameWork, is a Microsoft technology that is a server-side scripting technology that enables scripts embedded in Web pages to be executed by Internet servers. Multiple elevation of privilege vulnerabilities exist in Microsoft ASP.NET Core MVC. An attacker can explo...