Page 10 of 103 results (0.019 seconds)

CVSS: 9.3EPSS: 53%CPEs: 13EXPL: 0

CVE-2012-0015

https://notcve.org/view.php?id=CVE-2012-0015

14 Feb 2012 — Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Heap Corruption Vulnerability." Microsoft .NET Framework v2.0 SP2 y v3.5.1 no calcula correctamente la longitud de un búfer no especificado, lo que permite a atacantes remotos ejecutar código d... • http://www.us-cert.gov/cas/techalerts/TA12-045A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 15%CPEs: 41EXPL: 0

CVE-2011-1253

https://notcve.org/view.php?id=CVE-2011-1253

12 Oct 2011 — Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Class Inheritance Vulnerability." Microsoft .NET Framework v1.0 SP3, v1.1 SP1, v2.0 SP2, v3.5.1, y v4, y Silverlight v4 ... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-078 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 18%CPEs: 27EXPL: 0

CVE-2011-1978

https://notcve.org/view.php?id=CVE-2011-1978

10 Aug 2011 — Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or trigger arbitrary outbound network traffic via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Socket Restriction Bypass Vulnerability." Microsoft .NET Framework v2.0 SP2, v3.5.1 y v4 no valida adecuadamente el nivel de confianza de System.Net.Socke... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-069 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.3EPSS: 19%CPEs: 62EXPL: 0

CVE-2011-0664

https://notcve.org/view.php?id=CVE-2011-0664

16 Jun 2011 — Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking API functions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Array Offset Vulnerability." El framework Microsoft .NET 2.0 SP1 y SP2... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-039 • CWE-20: Improper Input Validation •

CVSS: 7.7EPSS: 3%CPEs: 64EXPL: 2

CVE-2011-1271 – Microsoft .NET Framework JIT Compiler - Optimization NULL String Remote Code Execution

https://notcve.org/view.php?id=CVE-2011-1271

10 May 2011 — The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework applic... • https://www.exploit-db.com/exploits/35740 • CWE-264: Permissions, Privileges, and Access Controls CWE-476: NULL Pointer Dereference •

CVSS: 9.3EPSS: 57%CPEs: 36EXPL: 0

CVE-2010-3958

https://notcve.org/view.php?id=CVE-2010-3958

13 Apr 2011 — The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Stack Corruption Vulnerability." El compilador x86 JIT de Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, y 4.0 no compila apropiadamente las llamadas a funciones, lo que perm... • http://www.us-cert.gov/cas/techalerts/TA11-102A.html • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 89%CPEs: 8EXPL: 6

CVE-2010-3332 – Microsoft ASP.NET - Padding Oracle (MS10-070)

https://notcve.org/view.php?id=CVE-2010-3332

22 Sep 2010 — Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability." Microsoft .NET Framework versiones 1.1 SP1, 2.0 SP1 y SP2, 3.5, 3.5 SP1, 3... • https://www.exploit-db.com/exploits/15213 • CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 9.3EPSS: 54%CPEs: 18EXPL: 0

CVE-2010-1898

https://notcve.org/view.php?id=CVE-2010-1898

11 Aug 2010 — The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NE... • http://www.us-cert.gov/cas/techalerts/TA10-222A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 54%CPEs: 39EXPL: 0

CVE-2009-2497

https://notcve.org/view.php?id=CVE-2009-2497

14 Oct 2009 — The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted Silverlight application, (3) a crafted ASP.NET application, or (4) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Vulnerability." La Rutina de Lenguaje Comun (CLR) en Microsoft .NET... • http://www.us-cert.gov/cas/techalerts/TA09-286A.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 60%CPEs: 40EXPL: 0

CVE-2009-0090

https://notcve.org/view.php?id=CVE-2009-0090

14 Oct 2009 — Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability." Microsoft .NET Framework v1.0 SP3, v1.1 SP1, y v2.0 SP1 no valida adecuadamente el código de .NET, lo que p... • http://www.us-cert.gov/cas/techalerts/TA09-286A.html • CWE-264: Permissions, Privileges, and Access Controls •