Page 20 of 131 results (0.003 seconds)

CVSS: 7.8EPSS: 62%CPEs: 6EXPL: 0

CVE-2013-3861

https://notcve.org/view.php?id=CVE-2013-3861

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, y 4.5 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación o cuelgue) a través de una secuencia de caracteres manipulados en datos JSON, también conocido como "Vulnerabilidad JSON Parsing." • http://www.us-cert.gov/ncas/alerts/TA13-288A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-082 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18842 • CWE-20: Improper Input Validation •

CVSS: 9.3EPSS: 43%CPEs: 7EXPL: 0

CVE-2013-3132

https://notcve.org/view.php?id=CVE-2013-3132

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, no valida adecuadamente los permisos de los objetos que usan el reflejo (reflection), lo que permite a atacantes remotos ejecutar código de su elección a través de (1) una aplicación manipulada para navegadores XAML (XBAP) o (2)una aplicación .NET Framework. Aka "Delegate Reflection Bypass Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17430 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 53%CPEs: 6EXPL: 0

CVE-2013-3171

https://notcve.org/view.php?id=CVE-2013-3171

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship, aka "Delegate Serialization Vulnerability." La funcionalidad de serialización en Microsoft .NET Framework v2.0 SP2, v3.5, v3.5 SP1, v3.5.1, v4, y v4.5 no comprueba correctamente los permisos de un objeto delegado, , lo que permite a atacantes remotos ejecutar código arbitrario a través de (1) una aplicación de navegador XAML manipulada (XBAP) o (2) una aplicación .NET Framework modificada que aprovecha una relación de confianza parcial, también conocido como "Delegate Serialization Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16867 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 64%CPEs: 36EXPL: 0

CVE-2013-3129

https://notcve.org/view.php?id=CVE-2013-3129

Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to execute arbitrary code via a crafted TrueType Font (TTF) file, aka "TrueType Font Parsing Vulnerability." Microsoft .NET Framework v3.0 SP2, v3.5, v3.5.1, v4, y v4.5; Silverlight v5 anteriores a v5.1.20513.0; win32k.sys en the kernel-mode drivers, y GDI+, DirectWrite, y Journal, en Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, y Windows RT; GDI+ en Office 2003 SP3, 2007 SP3, y 2010 SP1; GDI+ en Visual Studio .NET 2003 SP1; y GDI+ in Lync 2010, 2010 Attendee, 2013, y Basic 2013 permiten a atacantes remotos a ejecutar código a través de ficheros de fuentes TrueType manipulados, tambíen conocido como "TrueType Font Parsing Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-054 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17323 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17341 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 41%CPEs: 5EXPL: 0

CVE-2013-3133

https://notcve.org/view.php?id=CVE-2013-3133

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Anonymous Method Injection Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, no valida adecuadamente los permisos de los objetos que usan el reflejo (reflection), lo que permite a atacantes remotos ejecutar código de su elección a través de (1) una aplicación manipulada para navegadores XAML (XBAP) o (2)una aplicación .NET Framework. Aka "Anonymous Method Injection Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-190A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-052 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17421 • CWE-94: Improper Control of Generation of Code ('Code Injection') •