dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2

A flaw was found in dotnet. Running callbacks outside of locks results in Krestel deadlock using HTTP2. The highest threat from this vulnerability is to system availability...

PT-2021-1575 · Microsoft +3 · Visual Studio +5

Name of the Vulnerable Software and Affected Versions: ASP.NET Core and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation in ASP.NET Core and Visual Studio, which can lead to a denial-of-service condition. This can be exploited by a...

CVE-2020-24903

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting XSS caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the...

XSS Vulnerability in Kaixin Worklog System worklog

Kaixin Worklog Worklog system is a software system based on B/S to build the collaborative office within the enterprise. The system uses ASP.NET language development. Kai star worklog system worklog there are XSS vulnerabilities , attackers can use the vulnerability to obtain sensitive informatio...

FlexDotnetCMS Arbitrary ASP File Upload

This module exploits an arbitrary file upload vulnerability in FlexDotnetCMS v1.5.8 and prior in order to execute arbitrary commands with elevated privileges. The module first tries to authenticate to FlexDotnetCMS via an HTTP POST request to /login. It then attempts to upload a random TXT file a...

FlexDotnetCMS 1.5.8 Arbitrary ASP File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FlexDotnetCMS Arbitrary ASP File Upload', 'Description' = %q This module exploits an arbitrary file upload vulnerability in FlexDotnetCMS v1.5.8...

CVE-2020-27386

An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code e.g., ASP code in the form of a safe file type e.g., a TXT file, and then using the FileEditor in v1.5.8...

Webshell-Analyzer - Web Shell Scanner And Analyzer

Web shell analyzer is a cross platform stand-alone binary built solely for the purpose of identifying, decoding, and tagging files that are suspected to be web shells. The web shell analyzer is the bigger brother to the web shell scanner project http://github.com/tstillz/webshell-scan, which only...

October 1, 2020-KB4576945 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10, version 2004 and Windows Server, version 2004

None None...

CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

Microsoft .NET Core and ASP.NET Core Security Feature Bypass Vulnerability

Microsoft .NET Core and Microsoft ASP.NET Core are both products of Microsoft Corporation USA. NET Core is a free open source development platform. NET Core is a free open source development platform with multi-language support and cross-platform features.Microsoft ASP.NET Core is a framework of...

Microsoft SharePoint Server 2019 < 16.0.10366.12106 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to...

SQL injection vulnerability in the ne***.asp page of the website building system of Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is a high-tech Internet technology service provider. Hanzhong Qiyuan Power Network Co., Ltd. station-building system ne.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in im***.asp page of website building system of Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is a high-tech Internet technology service provider. Hanzhong Qiyuan Power Network Co., Ltd. website building system im.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in the ne***_vi***.asp page of the website building system of Wenzhou Qiaoyu Technology Co.

Wenzhou Qiaoyu Technology Co., Ltd. is an enterprise focusing on network marketing integration services. Wenzhou Qiaoyu Technology Co., Ltd. station-building system nevi.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

SQL injection vulnerability in ne***_vi***.asp page of website building system of Ruian City Business Enterprise Network Technology Co.

Ruian Business Enterprise Network Technology Co., Ltd. is a high-tech enterprise dedicated to the design and production of enterprise and commercial websites, to improve the level of SMEs' network marketing applications, and to enhance the comprehensive competitiveness of enterprises in the...

dotnet: ASP.NET Core Resource Consumption Denial of Service

A flaw was found in ASP.NET Core. Client disconnects were not properly handled in all circumstances. A remote, unauthenticated attacker could send specially crafted requests that would consume more disk and CPU resources than necessary potentially leading to a denial of service via resource...

dotnet: ASP.NET Core Resource Consumption Denial of Service

A flaw was found in ASP.NET Core. Client disconnects were not properly handled in all circumstances. A remote, unauthenticated attacker could send specially crafted requests that would consume more disk and CPU resources than necessary potentially leading to a denial of service via resource...

SQL injection vulnerability in im***.asp page of website building system of Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is a high-tech Internet technology service provider. Hanzhong Qiyuan Power Network Co., Ltd. website building system im.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in website builder system ne***.asp page of Hanzhong Qiyuan Power Network Co.

Hanzhong Qiyuan Power Network Co., Ltd. is an Internet technology service provider. A SQL injection vulnerability exists in the ne.asp page of the website building system of Hanzhong Qiyuan Power Network Co. An attacker can exploit the vulnerability to obtain sensitive information from the databa...