Asp.net

asp.net

Vendor: Microsoft • 9 CVEs

CVEs (9)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2010-2088 1Microsoft 1Asp.net Apr 29, 2026 May 27, 2010 N/A· v4 N/A· v3 4.3 MEDIUM· v2 ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.
CVE-2010-2084 1Microsoft 1Asp.net Apr 29, 2026 May 27, 2010 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related...Show more Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.Show less
CVE-2006-1364 1Microsoft 1Asp.net Apr 16, 2026 Mar 23, 2006 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption...Show more Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.Show less
CVE-2005-2224 1Microsoft 1Asp.net Apr 16, 2026 Jul 12, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.
CVE-2005-1665 1Microsoft 1Asp.net Apr 16, 2026 May 18, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.
CVE-2005-1664 1Microsoft 1Asp.net Apr 16, 2026 May 18, 2005 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the app...Show more The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the application's state has changed, or (3) use the ViewState to conduct attacks or expose content to third parties.Show less
CVE-2005-0452 1Microsoft 1Asp.net Apr 16, 2026 Feb 16, 2005 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters...Show more Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".Show less
CVE-2004-0847 1Microsoft 1Asp.net Apr 16, 2026 Nov 3, 2004 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encod...Show more The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."Show less
CVE-2003-0768 1Microsoft 1Asp.net Apr 16, 2026 Sep 22, 2003 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character in the beginning of a tag name.