CVSS: 4.3EPSS: 10%CPEs: 6EXPL: 0CVE-2013-5042
https://notcve.org/view.php?id=CVE-2013-5042
11 Dec 2013 — Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS Vulnerability." Vulnerabilidad de XSS en Microsoft ASP.NET SignalR 1.1.x anterior a la versión 1.1.4 y 2.0.x anterior a 2.0.1, y Visual Studio Team Foundation Server 2013, permite a atacantes remotos inyectar script web a... • http://www.securitytracker.com/id/1029463 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 52%CPEs: 48EXPL: 0CVE-2013-3128 – Microsoft Windows OpenType Font Parsing Persistent Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-3128
09 Oct 2013 — The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5, allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file, aka "OpenType Font Parsing Vulnerability." Los drivers kernel-mode en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S... • http://www.us-cert.gov/ncas/alerts/TA13-288A •
CVSS: 7.8EPSS: 63%CPEs: 6EXPL: 0CVE-2013-3860
https://notcve.org/view.php?id=CVE-2013-3860
09 Oct 2013 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document, aka "Entity Expansion Vulnerability." Microsoft. NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4 y 4.5 no analiza adecuadamente una DTD durante la validación de firmas digitales XML, lo que permite a atacantes remotos provocar una denegación de servicio (... • http://www.us-cert.gov/ncas/alerts/TA13-288A • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 77%CPEs: 6EXPL: 0CVE-2013-3861
https://notcve.org/view.php?id=CVE-2013-3861
09 Oct 2013 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, y 4.5 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación o cuelgue) a través de una secuencia de caracteres manipulados en datos JSON, también conocido como "Vulnerabilidad JSON Parsing." • http://www.us-cert.gov/ncas/alerts/TA13-288A • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 39%CPEs: 36EXPL: 0CVE-2013-3129
https://notcve.org/view.php?id=CVE-2013-3129
10 Jul 2013 — Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT; GDI+ in Office 2003 SP3, 2007 SP3, and 2010 SP1; GDI+ in Visual Studio .NET 2003 SP1; and GDI+ in Lync 2010, 2010 Attendee, 2013, and Basic 2013 allow remote attackers to exec... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 46%CPEs: 11EXPL: 0CVE-2013-3131
https://notcve.org/view.php?id=CVE-2013-3131
10 Jul 2013 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures, which allows remote attackers to execute arbitrary code via (1) a crafted .NET Framework application or (2) a crafted Silverlight application, aka "Array Access Violation Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, y Silverlight 5 no previenen adecuadamente los los cambios en los datos de las matrices m... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 3%CPEs: 7EXPL: 0CVE-2013-3132
https://notcve.org/view.php?id=CVE-2013-3132
10 Jul 2013 — Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Delegate Reflection Bypass Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, no valida adecuadamente los permisos de los objetos que usan el reflejo (reflection), lo que permite a atacant... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 6%CPEs: 5EXPL: 0CVE-2013-3133
https://notcve.org/view.php?id=CVE-2013-3133
10 Jul 2013 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Anonymous Method Injection Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5, no valida adecuadamente los permisos de los objetos que usan el reflejo (reflection), lo que permite a atacantes remotos ejecuta... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 49%CPEs: 5EXPL: 0CVE-2013-3134
https://notcve.org/view.php?id=CVE-2013-3134
10 Jul 2013 — The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate arrays of structures, which allows remote attackers to execute arbitrary code via a crafted .NET Framework application that changes array data, aka "Array Allocation Vulnerability." La Common Language Runtime (CLR) en Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, y 4.5 sobre plataformas de 64-bit no asignan adecuadamente matrices de estructuras, lo que permite a ata... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 6%CPEs: 6EXPL: 0CVE-2013-3171
https://notcve.org/view.php?id=CVE-2013-3171
10 Jul 2013 — The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship, aka "Delegate Serialization Vulnerability." La funcionalidad de serialización en Microsoft .NET Framework v2.0 SP2, v3.5, v3.5 SP1, v3.5.1, v4, y v4.5 no c... • http://www.us-cert.gov/ncas/alerts/TA13-190A • CWE-94: Improper Control of Generation of Code ('Code Injection') •