Irsdl

Existe uma vulnerabilidade que permite a execução remota de código devido à falha do Microsoft .NET Framework em validar adequadamente as entradas. Isso poderia permitir que um invasor remoto executasse código arbitrário utilizando um arquivo especialmente criado. A exploração bem-sucedida poderia permitir que um invasor assumisse o controle de um sistema afetado, instalasse programas, visualizasse, alterasse ou excluisse dados, ou criasse novas contas com direitos de usuário plenos. Usuários com menos direitos no sistema podem ser menos afetados do que aqueles que operam com direitos de usuário administrativo.

The issue is related to the incorrect handling of media during upload in the WordPress content management system, specifically affecting the `wp ajax upload attachment` function. This can allow a remote attacker to compromise data integrity. The problem is also described as allowing XSS in media uploads due to the mishandling of the `wp ajax upload attachment` function.

The issue is related to incorrect URL sanitization in the `wp kses bad protocol once` function, which can lead to cross-site scripting (XSS) attacks. This could allow a remote attacker to compromise data integrity.

The issue is related to an error in the content management system of WordPress, allowing for a Cross-Site Scripting (XSS) attack when authorized users view post previews. This could enable a remote attacker to compromise data integrity.

A security feature bypass issue exists due to improper handling of redirect requests by Microsoft browsers. This allows the browsers to bypass CORS redirect restrictions and follow redirect requests that should otherwise be ignored. An attacker who successfully exploits this could force the browser to send data to a destination web site of their choice.

The issue is related to the Microsoft.XMLDOM ActiveX control, which does not properly detect recursion during entity expansion. This allows remote attackers to cause a denial of service by consuming memory and CPU via a crafted XML document containing a large number of nested entity references.

The issue allows attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes. This can be demonstrated by a res:// URL. The vulnerability could allow an attacker to detect anti-malware applications in use on a target and use the information to avoid detection. It has been exploited in the wild.