Vulnerabilities > Microsoft > NET Framework

DATE CVE VULNERABILITY TITLE RISK
2007-04-10 CVE-2006-7192 Unspecified vulnerability in Microsoft .Net Framework 2.0
Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site scripting (XSS) attacks, or cause a denial of service, as demonstrated via an xss:expression STYLE attribute in a closing XSS HTML tag.
network
microsoft
4.3
2006-10-10 CVE-2006-3436 Cross-Site Scripting vulnerability in Microsoft .Net Framework 2.0
Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true".
network
microsoft
4.3
2006-07-11 CVE-2006-1300 Information Disclosure vulnerability in Microsoft .Net Framework 2.0
Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via unspecified "URL paths" that can access Application Folder objects "explicitly by name."
network
low complexity
microsoft
5.0
2006-03-30 CVE-2006-1511 Buffer Overflow vulnerability in Microsoft .NET Framework SDK MSIL Tools
Buffer overflow in the ILASM assembler in the Microsoft .NET 1.0 and 1.1 Framework might allow user-assisted attackers to execute arbitrary code via a .il file that calls a function with a long name.
network
high complexity
microsoft
5.1
2006-03-30 CVE-2006-1510 Buffer Overflow vulnerability in Microsoft .NET Framework SDK MSIL Tools
Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library, when used by the ILDASM disassembler in the Microsoft .NET 1.0 and 1.1 SDK, might allow user-assisted attackers to execute arbitrary code via a crafted .dll file with a large static method.
network
low complexity
microsoft
4.0
2005-08-19 CVE-2005-2127 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
network
low complexity
ati microsoft CWE-119
7.5
2005-03-14 CVE-2005-0509 Cross-Site Scripting vulnerability in .NET Framework
Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".
network
microsoft mono
4.3
2004-09-28 CVE-2004-0200 Unspecified vulnerability in Microsoft products
Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
network
microsoft
critical
9.3
2002-07-26 CVE-2002-0409 Remote Security vulnerability in Microsoft .Net Framework 1.0
orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.
network
low complexity
microsoft
5.0
2002-07-26 CVE-2002-0369 Buffer Overflow vulnerability in Microsoft .Net Framework 1.0
Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.
network
low complexity
microsoft
critical
10.0