CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2010-4225
https://notcve.org/view.php?id=CVE-2010-4225
Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .aspx (ASP.NET) applications via unknown vectors related to an "unloading bug." Vulnerabilidad no especificada en el módulo mod_mono para XSP en Mono v2.8.x anterior a v2.8.2, permite a atacantes remotos obtener el código fuente de aplicaciones .aspx (ASP.NET) a través de vectores desconocidos relacionados con un "error de descarga". • http://osvdb.org/70312 http://secunia.com/advisories/42842 http://www.mono-project.com/Vulnerabilities#XSP.2Fmod_mono_source_code_disclosure http://www.securityfocus.com/bid/45711 http://www.vupen.com/english/advisories/2011/0051 https://exchange.xforce.ibmcloud.com/vulnerabilities/64532 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 34%CPEs: 7EXPL: 2CVE-2010-4254 – Mono/Moonlight Generic Type Argument - Privilege Escalation
https://notcve.org/view.php?id=CVE-2010-4254
Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call. Mono, cuando Moonlight en versiones anteriores a la 2.3.0.1 o 2.99.x anteriores a la 2.99.0.10 es utilizado, no valida apropiadamente los argumentos a los métodos genéricos. Lo que permite a atacantes remotos evitar las restricciones genéricas y posiblemente ejecutar código arbitrario a través de una llamada a un método modificado. Mono/Moonlight suffers from a local privilege escalation vulnerability. • https://www.exploit-db.com/exploits/15974 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://secunia.com/advisories/42373 http://secunia.com/advisories/42877 http://www.exploit-db.com/exploits/15974 http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability http://www.securityfocus.com/bid/45051 http://www.vupen.com/english/advisories/2011/0076 https:/ • CWE-20: Improper Input Validation •
CVSS: 6.9EPSS: 0%CPEs: 66EXPL: 0CVE-2010-4159
https://notcve.org/view.php?id=CVE-2010-4159
Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges via a Trojan horse shared library in the current working directory. Vulnerabilidad de búsqueda de ruta no confiable en metadata/loader.c en Mono v2.8, permite a usuarios locales obtener privilegios a través de un troyano de la biblioteca compartida en el directorio de trabajo actual. • http://lists.ximian.com/pipermail/mono-patches/2010-October/177900.html http://marc.info/?l=oss-security&m=128939873515821&w=2 http://marc.info/?l=oss-security&m=128939912716499&w=2 http://marc.info/?l=oss-security&m=128941802415318&w=2 http://secunia.com/advisories/42174 http://www.mandriva.com/security/advisories?name=MDVSA-2010:240 http://www.mono-project.com/Vulnerabilities#Mono_Runtime_Insecure_Native_Library_Loading http://www.securityfocus.com/bid/44810 http://www.vupe •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1526
https://notcve.org/view.php?id=CVE-2010-1526
Multiple integer overflows in libgdiplus 2.6.7, as used in Mono, allow attackers to execute arbitrary code via (1) a crafted TIFF file, related to the gdip_load_tiff_image function in tiffcodec.c; (2) a crafted JPEG file, related to the gdip_load_jpeg_image_internal function in jpegcodec.c; or (3) a crafted BMP file, related to the gdip_read_bmp_image function in bmpcodec.c, leading to heap-based buffer overflows. Multiples desbordamientos de enteros en libgdiplus v.2.6.7, como los usados en Mono, permite a atacantes ejecutar código de su elección a través de (1) un archivo TIFF manipulado, relacionado con la función gdip_load_tiff_image de tiffcodec.c; (2) un archivo JPEG manipulado, relacionado con la función gdip_load_jpeg_image_internal en jpegcodec.c; o (3) un archivo BMP manipulado, relacionado con la función gdip_read_bmp_image de bmpcodec.c, causando desbordamientos de búfer basados en pila • http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://secunia.com/advisories/40792 http://secunia.com/secunia_research/2010-102 • CWE-189: Numeric Errors •
CVSS: 4.3EPSS: 0%CPEs: 62EXPL: 0CVE-2010-1459
https://notcve.org/view.php?id=CVE-2010-1459
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project. La configuración por defecto de ASP.NET de Mono anterior a v2.6.4 tiene valor FALSE en la propiedad EnableViewStateMac, esto permite a atacantes remotos provocar un ataque de secuencias de comandos en sitios cruzados (XSS), como se ha demostrado con el parámetro __VIEWSTATE en 2.0/menu/menu1.aspx en el XSP sample project. • http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/04/29/asp-net-cross-site-scripting-followup-mono.aspx http://www.mono-project.com/Vulnerabilities#ASP.NET_View_State_Cross-Site_Scripting http://www.securityfocus.com/bid/40351 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •