Pagelime CMS XSS / Credential Disclosure

================================================================================================================================================= PAGELIME CMS jQuery Cross Site Scripting / Unencrypted VIEWSTATE parameter / User credentials are sent in clear text / Login page password-guessing...

CVE-2010-4514

CVE-2010-4514 is an XSS vulnerability in DotNetNuke 5.05.01 and 5.06.00, affecting Install/InstallWizard.aspx. The underlying issue is improper handling of the __VIEWSTATE parameter, allowing remote attackers to inject arbitrary web script or HTML. Limited by the provided docs, exploitation statu...

CVE-2010-4514: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject arbitrary web script or HTML via the VIEWSTATE parameter. NOTE: some of these details are obtained from third party information...

Microsoft .NET '__VIEWSTATE' Cross-Site Scripting vulnerability

The host is running Microsoft .NET and is prone to Cross-Site Scripting Vulnerability. OpenVAS Vulnerability Test $Id: gbmsdotnetviewstatexssvuln.nasl 6519 2017-07-04 14:08:14Z cfischer $ Microsoft .NET 'VIEWSTATE' Cross-Site Scripting Vulnerability Authors: Antu Sanadi Copyright: Copyright c 201...

Microsoft .NET '__VIEWSTATE' Cross-Site Scripting vulnerability

Microsoft .NET is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2085: Improper Neutralization of Input During Web Page Generation

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting XSS attacks via the VIEWSTATE parameter...

CVE-2010-2088: Improper Neutralization of Input During Web Page Generation

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting XSS attacks against the form control via the VIEWSTATE parameter...

CVE-2010-1459: Improper Neutralization of Input During Web Page Generation

The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting XSS attacks, as demonstrated by the VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project...

CVE-2005-1665

The VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service CPU consumption via deeply nested markup...

CVE-2005-1665: Undefined Security Weakness

The VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service CPU consumption via deeply nested markup...

CVE-2005-1664: Undefined Security Weakness

The VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to 1 apply a ViewState generated from one view to a different view, 2 reuse ViewState information after the application's state has changed, or 3 use the ViewState to conduct attacks or expose...

ASP.NET __VIEWSTATE crypto validation prone to replay attacks

Good morning, ASP.NET's extremely popular VIEWSTATE functionality provides an automatic, uniform method for storing current state of all webpage "controls" including form fields, database views, etc, so that user-entered data automagically persists and is populated across newly rendered HTML, and...