CVSS: 5.0EPSS: 9%CPEs: 3EXPL: 4CVE-2006-6104 – Mono XSP 1.x/2.0 - Source Code Information Disclosure
https://notcve.org/view.php?id=CVE-2006-6104
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20. La clase System.Web del XSP para el servidor ASP.NET desde la versión 1.1 hasta la 2.0 en Mono no verifica apropiadamente los nombres de rutas locales, lo cual permite a atacantes remotos (1)leer el código fuente añadiendo un espacio (%20) a la URI y (2) leer las credenciales mediante una petición al Web.Config%20. • https://www.exploit-db.com/exploits/29302 http://fedoranews.org/cms/node/2400 http://fedoranews.org/cms/node/2401 http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html http://secunia.com/advisories/23432 http://secunia.com/advisories/23435 http://secunia.com/advisories/23462 http://secunia.com/advisories/23597 http://secunia.com/advisories/23727 http://secunia.com/advisories/23776 http://secunia.com/advisories/23779 http://security.gentoo.org/glsa •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2006-5072
https://notcve.org/view.php?id=CVE-2006-5072
The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack. Las clases System.CodeDom.Compiler en Novell Mono crean archivos temporales con permisos no seguros, lo cual permite a usuarios locales sobreescribir ficheros de su elección a ejecutar código de su elección a través de un ataque symlink. • http://fedoranews.org/cms/node/2401 http://secunia.com/advisories/22237 http://secunia.com/advisories/22277 http://secunia.com/advisories/22614 http://secunia.com/advisories/23154 http://secunia.com/advisories/23213 http://secunia.com/advisories/23776 http://security.gentoo.org/glsa/glsa-200611-23.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:188 http://www.novell.com/linux/security/advisories/2006_73_mono.html http://www.securityfocus.com/bid/20340 http& •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2006-2658
https://notcve.org/view.php?id=CVE-2006-2658
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request. Vulnerabilidad de atravesamiento de directorios en el componente xsp en mod_mono en Mono/C# web server, es usado en SUSE Open-Enterprise-Server 1 y SUSE Linux 9.2 hasta la 10.0, permite a un atacante remoto leer ficheros de su elección a través de la secuencia ..(punto punto)en una respueta HTTP. • http://lists.suse.com/archive/suse-security-announce/2006-Sep/0005.html http://secunia.com/advisories/21840 http://secunia.com/advisories/21847 http://securitytracker.com/id?1016821 http://www.securityfocus.com/bid/19929 http://www.vupen.com/english/advisories/2006/3552 •
CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 0CVE-2005-0509
https://notcve.org/view.php?id=CVE-2005-0509
Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<". • http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml http://marc.info/?l=bugtraq&m=110867912714913&w=2 http://secunia.com/advisories/14325 •