MS15-048: Vulnerabilities in the .NET Framework could allow elevation of privilege: May 12, 2015

This update resolves vulnerabilities in the Microsoft .NET Framework that include vulnerabilities that could allow elevation of privilege if an attacker sends specially crafted data to a WinForms application that is running in partial trust, and vulnerabilities that could allow denial of service...

PT-2015-5414

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.0 SP2 through 4.5.2 Description An information disclosure issue exists in Microsoft Windows due to the improper handling of OpenType fonts by the Windows DirectWrite library. This allows an attacker to...

Microsoft .NET Framework CVE-2015-1672 Remote Denial of Service Vulnerability

Description Microsoft .NET Framework is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to degrade the performance of a .NET-enabled website, causing a denial-of-service condition. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilo...

PT-2015-5416

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.2 Description The issue is caused by the improper handling of objects in memory by the Windows Forms WinForms libraries in Microsoft .NET Framework. This allows an attacker to potentially...

Microsoft .NET Framework CVE-2015-1673 Remote Privilege Escalation Vulnerability

Description Microsoft .NET Framework is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges within the context of the application; this can result in the attacker gaining complete control of the affected system. Technologies Affecte...

Microsoft .NET Framework Denial of Service (MS15-048: CVE-2015-1672)

A Denial of Service vulnerability has been reported in the Microsoft .Net Framework. The vulnerability is due to an error in the way that Microsoft .Net Framework handles XML documents with an invalid EncryptedData element. A remote attacker could exploit this vulnerability by sending specially...

Microsoft patch day 2015-4-14: the repair of many high-risk IE, Windows, Office vulnerabilities-vulnerability warning-the black bar safety net

Monthly the second Tuesday, Microsoft fixed the patch to fix the day, Microsoft on Tuesday（2015-4-14 the“patch day”on repairing a large number of vulnerabilities, which includes many IE, Windows, Office, high-risk vulnerabilities. Update announcement MS15-0 3 4 announcement MS15-0 3 4 announcemen...

Microsoft Windows .NET Framework Information Disclosure Vulnerability (3048010)

This host is missing an important security update according to Microsoft Bulletin MS15-041. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-1648

ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."...

CVE-2015-1648

The CVE-2015-1648 issue is an information-disclosure vulnerability in Microsoft .NET Framework’s ASP.NET when customErrors is disabled. The root cause is improper handling/sanitization of errors, allowing remote attackers to trigger requests that reveal parts of web configuration files. Affected ...

CVE-2015-1648

ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."...

MS15-041: Vulnerability in the .NET Framework could allow information disclosure: April 14, 2015

Resolves a vulnerability in the Microsoft .NET Framework that could allow information disclosure if an attacker sends a specially crafted web request to an affected server that has custom error messages disabled. An attacker who successfully exploits the vulnerability would be able to view parts ...

PT-2015-5412

Name of the Vulnerable Software and Affected Versions ASP.NET in Microsoft .NET Framework versions 1.1 SP1 through 4.5.2 Description An information disclosure issue exists due to improper handling of certain requests when custom error messages are disabled. This could allow an attacker to view...

Microsoft .NET Framework CVE-2015-1648 Information Disclosure Vulnerability

Description The Microsoft .NET Framework is prone to a remote information-disclosure vulnerability. Attackers can exploit this issue to gain access to sensitive information that may aid in further attacks. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya...

CVE-2015-1648: Undefined Security Weakness

ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."...

MS15-041: Vulnerability in .NET Framework Could Allow Information Disclosure (3048010)

The remote Windows host has a version of the Microsoft .NET Framework installed that is affected by an information disclosure vulnerability due to improper handling of requests on web servers that have custom error messages disabled. A remote, unauthenticated attacker can exploit this issue, via ...

KLA10556 Obtain sensitive information vulnerability in .NET Framework

An unspecified vulnerability was found in Microsoft .NET. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed request. Original advisories MS15-041 CVE-2015-1648 Exploitation Malware exists for th...

Microsoft XML Signature HMAC Truncation Bypass (MS10-041) - Ver2 (CVE-2009-0217)

The Microsoft .NET Framework is a component of the Microsoft Windows operating system that enables building and running software applications and Web services. A tampering vulnerability exists in the Microsoft .NET Framework that could allow an attacker to tamper with signed XML content without...

Microsoft .NET Framework S.DS.P Namespace Method Buffer Overflow - Ver2 (CVE-2013-0003)

A buffer overflow exists in the System.DirectoryServices.Protocols S.DS.P namespace method in the .NET framework. The vulnerability is due to an error in the validation of the size of objects in memory prior to copying them into an array.An attacker can remotely exploit this vulnerability by...

MS14-072: Vulnerability in .NET Framework Could Allow Elevation of Privilege (3005210)

The remote Windows host has a version of the Microsoft .NET Framework that is affected by a vulnerability related to how it handles TypeFilterLevel checks for some malformed objects. This can be used by a remote attacker to gain privilege elevation via a specially crafted packet sent to a host th...