CVE-2011-3417

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, ak...

Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

This host is missing a critical security update according to Microsoft Bulletin MS11-100. OpenVAS Vulnerability Test $Id: secpodms11-100.nasl 5362 2017-02-20 12:46:39Z cfi $ Vulnerabilities in .NET Framework Could Allow Elevation of Privilege 2638420 Authors: Sooraj KS Copyright: Copyright c 2011...

Microsoft .NET Framework 用户验证权限提升漏洞(CVE-2011-3416)

BUGTRAQ ID: 51201 CVE ID: CVE-2011-3416 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft .NET Framework在用户验证的实现上存在权限提升漏洞，攻击者可利用此漏洞非法访问另一个用户账户，以其权限执行任意命令。要利用此漏洞，非法攻击者需要在ASP.NET应用上注册一个帐户并了解目标用户的现有帐户名，然后使用之前注册的账目名访问该帐户来构造特制的Web请求。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x...

Microsoft .NET Framework 缓存处理代码执行漏洞

BUGTRAQ ID: 51203 CVE ID: CVE-2011-3417 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft .NET Framework在处理缓存内容的方式上存在权限提升漏洞，通过发送特制的链接并诱使用户打开此类链接，攻击者可利用此漏洞执行任意恶意代码。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET Framework 2.x Microsoft .NET Framework 1.x 厂商补丁： Microso...

Microsoft .NET Framework表单验证URL存在欺骗漏洞

BUGTRAQ ID: 51202 CVE ID: CVE-2011-3415 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft .NET Framework在表单验证过程中验证返回的URL时存在欺骗漏洞，成功利用此漏洞的攻击者可将用户重定向到恶意站点，然后执行钓鱼攻击，获取用户敏感信息。此漏洞不允许攻击者直接执行代码或提升其用户权限。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET Framework 2.x Microsoft...

Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

This host is missing a critical security update according to Microsoft Bulletin MS11-100. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft to Release Emergency Fix for ASP.NET DoS Flaw

UPDATED Microsoft on Thursday plans to release an emergency out-of-band update to address a vulnerability in ASP.NET that could allow an attacker to consume all of the resources on a vulnerable server with a single specially designed HTTP request. The vulnerability affects a wide range of Web...

Microsoft ASP.NET哈希冲突远程拒绝服务漏洞

UGTRAQ ID: 51186 CVE ID: CVE-2011-3414 ASP.NET是一套由Microsoft分发的帮助开发者构建基于WEB应用的系统。 Microsoft ASP.NET在处理其表单请求值时会造成哈希冲突，攻击者通过发送一些特制的ASP.NET表单请求到受影响ASP.NET站点利用此漏洞导致使用ASP.NET的站点CPU占用率剧增，失去响应正常情况的能力。 0 Microsoft .NET Framework 4.x Microsoft .NET Framework 3.x Microsoft .NET Framework 2.x Microsoft .NET...

Multiple Programming Language Implementations Vulnerable to Hash Table Collision Attacks

No description provided by source. US-CERT is aware of reports stating that multiple programming language implementations, including web platforms, are vulnerable to hash table collision attacks. This vulnerability could be used by an attacker to launch a denial-of-service attack against websites...

MS11-100: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

The remote Windows host is running a version of the Microsoft ASP.NET Framework that has multiple vulnerabilities. These include: - A flaw exists in the way ASP.NET generates hash tables for user-supplied values. By sending a small number of specially crafted posts to an ASP.NET server, an attack...

MS11-100: Vulnerability in the .NET Framework could allow elevation of privilege: December 29, 2011

This article contains details for the ASP.NET update for the .NET Framework.IntroductionMicrosoft has released security bulletin MS11-100. To view the complete security bulletin, visit one of the following Microsoft websites:Home...

新 点 软件 asp.net vulnerability small analysis-vulnerability warning-the black bar safety net

The new Point is mainly used gov net web site, the vulnerability relatively tasteless, if the site did not close the members register is available, the Main Station fckeditor vulnerability has been patch www.xxxx.com/member of path/ registration after login, click on Edit to add information, add...

Million ASP.Net web sites affected with mass SQL injection attack

Million ASP.Net web sites affected with mass SQL injection attack Hackers are in the midst of a massively successful SQL injection attack targeting websites built on Microsoft's ASP.Net platform. About 180,000 pages have been affected so far, security researchers say. Attackers have planted...

Million ASP.Net web sites affected with mass SQL injection attack

Million ASP.Net web sites affected with mass SQL injection attack Hackers are in the midst of a massively successful SQL injection attack targeting websites built on Microsoft's ASP.Net platform. About 180,000 pages have been affected so far, security researchers say. Attackers have planted...

Mass Injection Attack Targets ASP.NET Sites

There is yet another large-scale injection attack going on right now, with nearly 200,000 pages affected so far. The compromised pages are serving visitors with malicious code that sends them off to a remote server for installation of malware. The attack is the latest in a series of similar...

Design/Logic Flaw

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application aka XBAP, 2 a crafted ASP.NET application, 3 a crafted .NE...

GotoCode Online Classifieds - Multiple Vulnerabilities

GotoCode Online Classifieds - Multiple Vulnerabilities Exploit Title : GotoCode Online Classifieds Multiple Vulnerabilities Vulnerability : Privilege Escalation / Remote Database Download Date : 09/10/2011 Author : Nathaniel Carew Email : [email protected] Impact : High Software Link :...

GotoCode Online Classifieds Access Bypass

Exploit Title : GotoCode Online Classifieds Multiple Vulnerabilities Vulnerability : Privilege Escalation / Remote Database Download Date : 09/10/2011 Author : Nathaniel Carew Email : [email protected] Impact : High Software Link : http://www.gotocode.com/apps.asp?appid=5& Platform : ASP.NET Test...

GotoCode Online Bookstore Privilege Escalation / Database Disclosure

Exploit Title : GotoCode Online Bookstore Multiple Vulnerabilities Vulnerability : Privilege Escalation / Remote Database Download Date : 03/10/2011 Author : Nathaniel Carew Email : [email protected] Impact : High Software Link : http://www.gotocode.com/apps.asp?appid=3& Platform : ASP.NET Tested...

GotoCode Online Bookstore - Multiple Vulnerabilities

Exploit Title : GotoCode Online Bookstore Multiple Vulnerabilities Vulnerability : Privilege Escalation / Remote Database Download Date : 03/10/2011 Author : Nathaniel Carew Email : [email protected] Impact : High Software Link : http://www.gotocode.com/apps.asp?appid=3& Platform : ASP.NET Tested...