Week in Review: Web Insecurity and Fixes for Stuxnet

Web insecurity was in the news this week, with a major flaw in the security of ASP.NET and some sobering statistics on Web site infections. When your bank account gets hacked – is it your fault? And, with a patch out for one of four ! zero day exploits used by Stuxnet, security experts wonder if...

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say...

online product / shop online (productdetail.cfm) SQL Injection

Exploit for asp platform in category web applications ============================================================== online product / shop online productdetail.cfm SQL Injection ============================================================== + Category : vurnerebility SQLI online product + Running...

Rapid7 Security Advisory 36

R7-0036: FCKEditor.NET File Upload Code Execution August 30, 2010 -- Vulnerability Details: FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP code via the ASP.NET connector in FCKEditor. The vulnerability requires that the remote...

BugTracker.NET 3.4.3 SQL Injection

BugTracker.net 3.4.3 SQL Injection Name BugTracker.NET Vendor http://www.ifdefined.com/www/ Versions Affected 3.4.4 when custom fields are used Author Mark van Tilburg Website http://markvt.info Contact markvantilburg at gmail dot com Date 2010-08-22 X. INDEX I. ABOUT THE APPLICATION II...

CVE-2010-1898

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

CVE-2010-1898

CVE-2010-1898 is a remote code execution vulnerability in the Microsoft .NET CLR handling delegates to virtual methods, affecting CLR-based apps and Silverlight. The issue enables arbitrary code execution via three attack scenarios: XBAPs (XAML browser applications), ASP.NET pages, or standalone ...

CVE-2010-1898

The Common Language Runtime CLR in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote...

Microsoft Security Bulletin MS10-060 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (2265906)

Microsoft Security Bulletin MS10-060 - Critical Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution 2265906 Published: August 10, 2010 Version: 1.0 General Information Executive Summary This security update resolves two...

Fedora Update for xsp FEDORA-2010-10332

Check for the Version of xsp OpenVAS Vulnerability Test Fedora Update for xsp FEDORA-2010-10332 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora Update for mod_mono FEDORA-2010-10332

Check for the Version of modmono OpenVAS Vulnerability Test Fedora Update for modmono FEDORA-2010-10332 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] Fedora 13 Update: mod_mono-2.6.3-1.fc13

modmono allows Apache to serve ASP.NET pages by proxying the requests to a slightly modified version of the XSP server, called mod-mono-server, that is installed along with XSP...

[SECURITY] Fedora 13 Update: xsp-2.6.4-1.fc13

XSP is a standalone web server written in C that can be used to run ASP.NET applications as well as a set of pages, controls and web services that you can use to experience ASP.NET...

DorsaCMS Remote File Upload Vulnerability

Exploit for php platform in category web applications ========================================= DorsaCMS Remote File Upload Vulnerability ========================================= By : NetQurd SPT : d3c0der , HIV Security Team Mail : email protected , email protected Web : Http://AttackerZ.iR Hom...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

SQL Injection Attacks Aimed at Stealing Gaming Credentials, Experts Say

The mass SQL injection attack that has been ongoing for a week or so now is designed mainly to steal credentials for online games and is quite well planned and organized, experts say. The attack, which has been using two specific domains as part of a widespread SQL injection campaign, is targetin...

Cute Editor online editor local include vulnerability xday-vulnerability warning-the black bar safety net

First, the vulnerability description: CuteEditor for ASP. NET is built on an Html Foundation, most easy-to-use, most powerful WYSIWYG Asp. net online editor. CuteEditor can help Asp. net developers to easily on the original text boxTextareacontentincluding text, images and other Html contentfor...

Mass SQL Injection Attack Hits Sites Running IIS

There’s a large-scale attack underway that is targeting Web servers running Microsoft’s IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there’s no clear indication of who’s behind the campaign righ...