Soroush Dalili

The issue is related to errors in security settings of the Microsoft .NET Framework platform. It allows a remote attacker to access a closed part of a web application by sending a specially formed request. This is a security-feature bypass issue that can affect the system.

The issue is related to an elevation-of-privilege vulnerability in ASP.NET, which allows attackers to affect the system. This vulnerability is associated with insufficient access controls in the Microsoft .NET Framework. Exploitation of this vulnerability may enable a remote attacker to elevate their privileges. The vulnerability is also known as "Cookieless DuoDrop" and involves an IIS Auth Bypass and App Pool Privesc in the ASP-NET Framework.

The issue allows deserialization of untrusted data.

The issue is related to the incorrect handling of media during upload in the WordPress content management system, specifically affecting the `wp ajax upload attachment` function. This can allow a remote attacker to compromise data integrity. The problem is also described as allowing XSS in media uploads due to the mishandling of the `wp ajax upload attachment` function.

The issue is related to an error in the content management system of WordPress, allowing for a Cross-Site Scripting (XSS) attack when authorized users view post previews. This could enable a remote attacker to compromise data integrity.

The issue is related to incorrect URL sanitization in the `wp kses bad protocol once` function, which can lead to cross-site scripting (XSS) attacks. This could allow a remote attacker to compromise data integrity.

The issue allows for privilege escalation due to the mishandling of %0A in AUTH.TAB after a password-change request, which could lead to the creation of admin accounts.

The issue allows for Directory Traversal, enabling unauthorized actions such as reading messages of other users, uploading files, and deleting files. This is due to the mishandling of "/../" and "/.. /" sequences.

The issue allows for XXE (XML External Entity) attacks through an XML document in the `request.aspx` `Options` parameter.

The issue allows for Stored XSS attacks through the use of a malformed "<img/src" tag without a ">" character in the body of an e-mail message.

A remote code execution issue exists when Microsoft .NET Framework processes untrusted input. This could allow a remote attacker to execute arbitrary code using a specially crafted document or application. An attacker who successfully exploits this issue could take control of an affected system. To exploit the issue, an attacker would need to be able to upload a specially crafted file to a web application.

The issue allows attackers to execute code by decompiling a compiled .NET object, such as a DLL or EXE file, with a specific file. This is due to the deserialization of untrusted data.

The issue allows attackers to execute code by decompiling a compiled .NET object, such as a DLL or EXE file, with a specific embedded resource file.

A remote code execution issue exists in Microsoft SharePoint due to the software's failure to properly check the source markup of an application package. This allows an attacker to run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account by uploading a specially crafted SharePoint application package.

A Remote Code Execution issue exists in .NET software due to its failure to check the source markup of a file. This allows an attacker to run arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. The exploitation requires a user to open a specially crafted file with an affected version of .NET.

A remote code execution issue exists due to improper input validation in the Microsoft .NET Framework. This could allow an attacker to take control of an affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited user rights compared to those operating with administrative rights.

The issue is related to a use-after-free error when working with the CElement object, allowing remote attackers to execute arbitrary code or cause a denial of service by accessing a specially crafted website. This could corrupt memory, enabling an attacker to execute code in the context of the current user.

A cross-site scripting (XSS) issue allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks.

The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.