18 results · Feed
-
High 8.8
The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-…
-
Unscored —
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
-
Unscored —
The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and conseque…
-
Unscored —
The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-si…
-
Unscored —
The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbidde…
-
Unscored —
Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain t…
-
Unscored —
Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges …
-
Medium —
Mono ASP.NET View State Cross-Site Scripting (XSS) vulnerability
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.asp…
-
Medium —
Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…
-
Unscored —
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementatio…
-
Unscored —CVE-2008-3906 Public exploit
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP header…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote…
-
Unscored —
Buffer overflow in the Mono.Math.BigInteger class in Mono 1.2.5.1 and earlier allows context-dependent attackers to exe…
-
Unscored —CVE-2006-6104 Public exploit
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, wh…
-
Unscored —
The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local…
-
Unscored —CVE-2005-0509 EPSS 16%
Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote att…