Vulnerabilities > Microsoft > NET Framework > 2.0

DATE CVE VULNERABILITY TITLE RISK
2010-08-11 CVE-2010-1898 Code Injection vulnerability in Microsoft .Net Framework and Silverlight
The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before 3.0.41130.0 on Mac OS X, does not properly handle interfaces and delegations to virtual methods, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Virtual Method Delegate Vulnerability."
network
microsoft apple CWE-94
critical
9.3
2009-08-12 CVE-2009-1536 Improper Input Validation vulnerability in Microsoft .Net Framework, Windows Server 2008 and Windows Vista
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
network
high complexity
microsoft CWE-20
2.6
2008-08-27 CVE-2008-3843 Cross-Site Scripting vulnerability in Microsoft .Net Framework 1.0/1.1/2.0
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.
network
microsoft CWE-79
4.3
2008-08-27 CVE-2008-3842 Cross-Site Scripting vulnerability in Microsoft .Net Framework 1.0/1.1/2.0
Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.
network
microsoft CWE-79
4.3
2007-07-10 CVE-2007-0043 Buffer Errors vulnerability in Microsoft .Net Framework 1.0/1.1/2.0
The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow, aka ".NET JIT Compiler Vulnerability".
network
microsoft CWE-119
critical
9.3
2007-07-10 CVE-2007-0042 Information Exposure vulnerability in Microsoft .Net Framework 1.0/1.1/2.0
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."
network
low complexity
microsoft CWE-200
7.8
2007-07-10 CVE-2007-0041 Buffer Errors vulnerability in Microsoft .Net Framework 1.0/1.1/2.0
The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.
network
microsoft CWE-119
critical
9.3
2007-04-10 CVE-2006-7192 Unspecified vulnerability in Microsoft .Net Framework 2.0
Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site scripting (XSS) attacks, or cause a denial of service, as demonstrated via an xss:expression STYLE attribute in a closing XSS HTML tag.
network
microsoft
4.3
2006-10-10 CVE-2006-3436 Cross-Site Scripting vulnerability in Microsoft .Net Framework 2.0
Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true".
network
microsoft
4.3
2006-07-11 CVE-2006-1300 Information Disclosure vulnerability in Microsoft .Net Framework 2.0
Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."
network
low complexity
microsoft
5.0