Multiple vendor SOAP server (XML parser) denial of service (DTD parameter entities)

/////////////////////////////////////////////////////////////////////////////// //========================== Security Advisory ==========================// ///////////////////////////////////////////////////////////////////////////////...

Multiple Vendor SOAP server (XML parser) attribute blowup DoS

/////////////////////////////////////////////////////////////////////////////// //========================== Security Advisory ==========================// ///////////////////////////////////////////////////////////////////////////////...

CVE-2003-0768

Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting XSS and Script Injection protection feature via a null character in the beginning of a tag name...

CVE-2003-0768

Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting XSS and Script Injection protection feature via a null character in the beginning of a tag name...

CVE-2003-0768

CVE-2003-0768 concerns Microsoft ASP.NET 1.1. The description across provided sources states that remote attackers can bypass the Cross-Site Scripting (XSS) and Script Injection protection feature by injecting a null character at the beginning of a tag name. The connected documents confirm the af...

ASP.NET crossite scripting protection bypass

It's possible to insert null character after tag opening...

Advisory: Incorrect Handling of XSS Protection in ASP.Net

Monday, September 8th, 2003 Background: ---------- As part of Microsoft's attempts to make it easier for application developers to write secure code, Microsoft has added a new feature, named Request Validation, to the ASP.Net 1.1 framework. This feature is provides out of the box protection again...

ZH2003-24SA (security advisory): ChitChat.NET XSS Vulnerability

ZH2003-24SA security advisory: ChitChat.NET XSS Vulnerability Published: 13 august 2003 Released: 13 august 2003 Name: ChitChat.NET Affected Systems: 2.0 Issue: Remote attackers can inject XSS script Author: [email protected] Vendor: http://clickcess.com/ Description Zone-h Security Team has...

CVE-2002-0072

The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server IIS 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service crash when the URL parser accesses a nu...

CVE-2002-0072

CVE-2002-0072 describes a denial-of-service in Microsoft IIS 4.0/5.0/5.1 caused by the w3svc.dll FP2002/ISAPI filter when handling an overly long URL. The error handling rewrites a URL to a null value and then dereferences it, crashing Inetinfo.exe. Affected components: FP2002 Front Page Server E...

CVE-2002-0369

Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service restart and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode...

CVE-2002-0369

CVE-2002-0369 describes a buffer overflow in the ASP.NET Worker Process when StateServer mode is enabled, triggered by a routine that processes cookies. The issue can allow a remote attacker to cause a denial of service (restart) and potentially execute arbitrary code with the worker process priv...

MS02-026: ASP.NET Worker Process StateServer Mode Remote Overflow (322289)

The remote ASP.NET installation might be vulnerable to a buffer overflow when an application enables StateServer mode. An attacker could use it to cause a denial of service or run arbitrary code with the same privileges as the process being exploited typically an unprivileged account. C Tenable...

CVE-2002-0369

Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service restart and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode...

Microsoft ASP.NET contains buffer overflow

Overview Microsoft ASP.NET contains buffer overflow in routine that handles the processing of cookies in StateServer mode. Description ASP.NET is a programming framework provided by Microsoft. For more details about this framework, please see the official web page.A remotely exploitable buffer...

Microsoft ASP.NET buffer overflow

Buffer overflow on state cookie processing...

Security Bulletin MS02-026: Unchecked Buffer in ASP.NET Worker Process (Q322289)

---------------------------------------------------------------------- Title: Unchecked Buffer in ASP.NET Worker Process Q322289 Date: 06 June 2002 Software: .NET Framework Impact: Denial of service, potentially run code of attacker's choice Max Risk: Moderate Bulletin: MS02-026 Microsoft...

Microsoft ASP.NET Application Tracing trace.axd Information Disclosure

The ASP.NET web application running in the root directory of the remote web server has application tracing enabled. This allows an unauthenticated, remote attacker to view the last 50 web requests made to the server, including sensitive information like Session ID values and the physical path to...

Microsoft Internet Information Server (IIS) vulnerable to DoS when URL request exceeds maximum allowed length

Overview Intruders may be able to cause the IIS service to fail by sending a particular kind of overly-long URL. Description ISAPI is a programming interface to IIS that can be used to modify or extend the behavior of IIS. Programs written using ISAPI are known as either filters or extension,...

Microsoft ASP.NET Malformed File Request Path Disclosure

ASP.NET is vulnerable to a path disclosure attack. This allows an attacker to determine where the remote web root is physically stored in the remote file system, hence gaining more information about the remote system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...