Mono <= 2.0 'System.Web' HTTP Header Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30867/info Mono is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sanitize input. By inserting arbitrary headers into an HTTP response, attackers may be able to launch...

Ubuntu Update for mono USN-1517-1

Ubuntu Update for Linux kernel vulnerabilities USN-1517-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15171.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for mono USN-1517-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Mono System.Web模块HTTP头注入漏洞

BUGTRAQ ID: 30867 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 Mono的Sys.Web模块没有正确地过滤某些参数便在HTTP响应中使用，远程攻击者可以通过提交恶意HTTP请求导致注入任意HTML和脚本代码并在用户浏览器会话中执行。 Mono 2.0 Mono ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mono-project.com/ script runat="server" void PageLoadobject o, EventArgs e // Query...

Ubuntu 6.06 LTS / 6.10 : mono vulnerability (USN-397-1)

Jose Ramon Palanco discovered that the mono System.Web class did not consistently verify local file paths. As a result, the source code for mono web applications could be retrieved remotely, possibly leading to further compromise via the application's source. Note that Tenable Network Security ha...

Mono System.Web StaticFileHandler.cs源码泄露漏洞

BUGTRAQ ID: 26166 CVECAN ID: CVE-2007-5473 Mono是基于.NET框架的开源开发平台，允许开发人员构建Linux和跨平台的应用。 运行在Windows平台上的Mono中StaticFileHandler.cs文件没有正确地处理某些用户请求，可能导致源码泄露。 如果请求中所使用的文件名以空格或句号结束的话，Win32子系统就无法正确地处理这样的文件名，会忽略拖尾字符，允许调用的应用程序打开磁盘上的文件，即使该文件的名称不包含有请求中所使用的拖尾字符。发送上述请求就会导致XSP返回所请求页面的源码。 Mono 1.x...

CVE-2007-5473

StaticFileHandler.cs in System.Web in Mono before 1.2.5.2, when running on Windows, allows remote attackers to obtain source code of sensitive files via a request containing a trailing 1 space or 2 dot, which is not properly handled by XSP...

CVE-2007-5473

The CVE-2007-5473 entry concerns Mono before 1.2.5.2. StaticFileHandler.cs in System.Web on Windows fails to properly handle a request trailing with a space or dot in XSP, allowing remote attackers to disclose source code of sensitive files. Affected component: Mono’s System.Web.StaticFileHandler...

CVE-2007-5473: Exposure of Sensitive Information to an Unauthorized Actor

StaticFileHandler.cs in System.Web in Mono before 1.2.5.2, when running on Windows, allows remote attackers to obtain source code of sensitive files via a request containing a trailing 1 space or 2 dot, which is not properly handled by XSP...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

DEBIAN-CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

CVE-2006-6104 affects the Mono platform’s XSP/ASP.NET server. The System.Web class does not properly verify local pathnames, allowing remote attackers to read sensitive content: source code by appending a space to a URI, and Web.Config via a Web.Config%20 request. The vulnerability lies in Mono 1...

CVE-2006-6104: Undefined Security Weakness

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...