All the vulnerabilites related to Microsoft Corporation - Microsoft .NET Framework
cve-2017-8759
Vulnerability from cvelistv5
Published
2017-09-13 01:00
Modified
2024-09-17 01:56
Severity
Summary
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."
References
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/100742 | vdb-entry, x_refsource_BID |
| https://github.com/bhdresh/CVE-2017-8759 | x_refsource_MISC |
| https://github.com/nccgroup/CVE-2017-8759 | x_refsource_MISC |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759 | x_refsource_CONFIRM |
| https://www.exploit-db.com/exploits/42711/ | exploit, x_refsource_EXPLOIT-DB |
| http://www.securitytracker.com/id/1039324 | vdb-entry, x_refsource_SECTRACK |
| https://github.com/GitHubAssessments/CVE_Assessments_01_2020 | x_refsource_MISC |
Impacted products
| Vendor | Product |
|---|---|
| Microsoft Corporation | Microsoft .NET Framework |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:48:22.678Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100742",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100742"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/bhdresh/CVE-2017-8759"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nccgroup/CVE-2017-8759"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759"
},
{
"name": "42711",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/42711/"
},
{
"name": "1039324",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039324"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/GitHubAssessments/CVE_Assessments_01_2020"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft .NET Framework",
"vendor": "Microsoft Corporation",
"versions": [
{
"status": "affected",
"version": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7"
}
]
}
],
"datePublic": "2017-09-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka \".NET Framework Remote Code Execution Vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-26T15:15:15",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "100742",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100742"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bhdresh/CVE-2017-8759"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nccgroup/CVE-2017-8759"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759"
},
{
"name": "42711",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/42711/"
},
{
"name": "1039324",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039324"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/GitHubAssessments/CVE_Assessments_01_2020"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"DATE_PUBLIC": "2017-09-12T00:00:00",
"ID": "CVE-2017-8759",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft .NET Framework",
"version": {
"version_data": [
{
"version_value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7"
}
]
}
}
]
},
"vendor_name": "Microsoft Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka \".NET Framework Remote Code Execution Vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100742",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100742"
},
{
"name": "https://github.com/bhdresh/CVE-2017-8759",
"refsource": "MISC",
"url": "https://github.com/bhdresh/CVE-2017-8759"
},
{
"name": "https://github.com/nccgroup/CVE-2017-8759",
"refsource": "MISC",
"url": "https://github.com/nccgroup/CVE-2017-8759"
},
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759",
"refsource": "CONFIRM",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759"
},
{
"name": "42711",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42711/"
},
{
"name": "1039324",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039324"
},
{
"name": "https://github.com/GitHubAssessments/CVE_Assessments_01_2020",
"refsource": "MISC",
"url": "https://github.com/GitHubAssessments/CVE_Assessments_01_2020"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2017-8759",
"datePublished": "2017-09-13T01:00:00Z",
"dateReserved": "2017-05-03T00:00:00",
"dateUpdated": "2024-09-17T01:56:49.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-0248
Vulnerability from cvelistv5
Published
2017-05-12 14:00
Modified
2024-08-05 12:55
Severity
Summary
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."
References
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/98117 | vdb-entry, x_refsource_BID |
| http://www.securitytracker.com/id/1038458 | vdb-entry, x_refsource_SECTRACK |
Impacted products
| Vendor | Product |
|---|---|
| Microsoft Corporation | Microsoft .NET Framework |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:55:19.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248"
},
{
"name": "98117",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98117"
},
{
"name": "1038458",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038458"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft .NET Framework",
"vendor": "Microsoft Corporation",
"versions": [
{
"status": "affected",
"version": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7"
}
]
}
],
"datePublic": "2017-05-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Security Feature Bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-07T09:57:01",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248"
},
{
"name": "98117",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98117"
},
{
"name": "1038458",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038458"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2017-0248",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft .NET Framework",
"version": {
"version_data": [
{
"version_value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7"
}
]
}
}
]
},
"vendor_name": "Microsoft Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Security Feature Bypass"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248",
"refsource": "CONFIRM",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248"
},
{
"name": "98117",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98117"
},
{
"name": "1038458",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038458"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2017-0248",
"datePublished": "2017-05-12T14:00:00",
"dateReserved": "2016-09-09T00:00:00",
"dateUpdated": "2024-08-05T12:55:19.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
jvndb-2011-000051
Vulnerability from jvndb
Published
2011-07-15 16:32
Modified
2011-07-15 16:32
Summary
ASP.NET vulnerable to cross-site scripting
Details
ASP.NET may create web applications for mobile devices that contain a cross-site scripting vulnerability.
ASP.NET contains an issue in the handling of session ID's in mobile devices. When "Mobile Controls" are used in ASP.NET to develop web applications for mobile devices, the application may contain a cross-site scripting vulnerability.
Keigo Yamazaki of LAC Co., Ltd reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL |
|---|---|
| JVN | https://jvn.jp/en/jp/JVN87908726/index.html |
| Cross-site Scripting(CWE-79) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
| Vendor | Product |
|---|---|
| Microsoft Corporation | Microsoft .NET Framework |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000051.html",
"dc:date": "2011-07-15T16:32+09:00",
"dcterms:issued": "2011-07-15T16:32+09:00",
"dcterms:modified": "2011-07-15T16:32+09:00",
"description": "ASP.NET may create web applications for mobile devices that contain a cross-site scripting vulnerability.\r\n\r\nASP.NET contains an issue in the handling of session ID\u0027s in mobile devices. When \"Mobile Controls\" are used in ASP.NET to develop web applications for mobile devices, the application may contain a cross-site scripting vulnerability.\r\n\r\nKeigo Yamazaki of LAC Co., Ltd reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000051.html",
"sec:cpe": {
"#text": "cpe:/a:microsoft:.net_framework",
"@product": "Microsoft .NET Framework",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-000051",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN87908726/index.html",
"@id": "JVN#87908726",
"@source": "JVN"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "ASP.NET vulnerable to cross-site scripting"
}
jvndb-2011-003557
Vulnerability from jvndb
Published
2013-11-15 15:54
Modified
2013-11-15 15:54
Summary
ASP.NET vulnerable to open redirect
Details
ASP.NET provided by Microsoft contains an open redirect vulnerability due to an issue in the login component.
ASP.NET provided by Microsoft contains an open redirect vulnerability due to an issue in the login component. Therefore a web application that implements ASP.NET may be vulnerable.
Tomoki Sanaki of NTT Communications Corporation Security Operation Center reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-003557.html",
"dc:date": "2013-11-15T15:54+09:00",
"dcterms:issued": "2013-11-15T15:54+09:00",
"dcterms:modified": "2013-11-15T15:54+09:00",
"description": "ASP.NET provided by Microsoft contains an open redirect vulnerability due to an issue in the login component.\r\n\r\nASP.NET provided by Microsoft contains an open redirect vulnerability due to an issue in the login component. Therefore a web application that implements ASP.NET may be vulnerable.\r\n\r\nTomoki Sanaki of NTT Communications Corporation Security Operation Center reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-003557.html",
"sec:cpe": [
{
"#text": "cpe:/a:microsoft:.net_framework",
"@product": "Microsoft .NET Framework",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:microsoft:windows_7",
"@product": "Microsoft Windows 7",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:microsoft:windows_server_2003",
"@product": "Microsoft Windows Server 2003",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:microsoft:windows_server_2008",
"@product": "Microsoft Windows Server 2008",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:microsoft:windows_vista",
"@product": "Microsoft Windows Vista",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:microsoft:windows_xp",
"@product": "Microsoft Windows XP",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "2.6",
"@severity": "Low",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-003557",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN71256611/index.html",
"@id": "JVN#71256611",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3415",
"@id": "CVE-2011-3415",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3415",
"@id": "CVE-2011-3415",
"@source": "NVD"
},
{
"#text": "http://www.npa.go.jp/cyberpolice/important/2011/20111230_1553.html",
"@id": "Microsoft Security Bulletin for December 2011",
"@source": "AT-POLICE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-20",
"@title": "Improper Input Validation(CWE-20)"
}
],
"title": "ASP.NET vulnerable to open redirect"
}
jvndb-2011-000039
Vulnerability from jvndb
Published
2011-06-16 12:23
Modified
2011-06-16 12:23
Summary
ASP.NET vulnerable to cross-site scripting
Details
ASP.NET contains a cross-site scripting vulnerability.
ASP.NET contains an issue in the escape processes for string output. Web applications that use ASP.NET may contain a cross-site scripting vulnerability.
Masato Anzai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL |
|---|---|
| JVN | https://jvn.jp/en/jp/JVN72586781/index.html |
| Cross-site Scripting(CWE-79) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
| Vendor | Product |
|---|---|
| Microsoft Corporation | Microsoft .NET Framework |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000039.html",
"dc:date": "2011-06-16T12:23+09:00",
"dcterms:issued": "2011-06-16T12:23+09:00",
"dcterms:modified": "2011-06-16T12:23+09:00",
"description": "ASP.NET contains a cross-site scripting vulnerability.\r\n\r\nASP.NET contains an issue in the escape processes for string output. Web applications that use ASP.NET may contain a cross-site scripting vulnerability.\r\n\r\nMasato Anzai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000039.html",
"sec:cpe": {
"#text": "cpe:/a:microsoft:.net_framework",
"@product": "Microsoft .NET Framework",
"@vendor": "Microsoft Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-000039",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN72586781/index.html",
"@id": "JVN#72586781",
"@source": "JVN"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "ASP.NET vulnerable to cross-site scripting"
}