CVE

Id
44043  
CVE No.
CVE-2010-1459  
Status
Candidate  
Description
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.  
Phase
Assigned (20100416)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
480786 44043 CVE-2010-1459 MISC:http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2010/04/29/asp-net-cross-site-scripting-followup-mono.aspx  View
480787 44043 CVE-2010-1459 CONFIRM:http://www.mono-project.com/Vulnerabilities#ASP.NET_View_State_Cross-Site_Scripting  View
480788 44043 CVE-2010-1459 SUSE:SUSE-SR:2010:012  View
480789 44043 CVE-2010-1459 URL:http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html  View
480790 44043 CVE-2010-1459 SUSE:SUSE-SR:2010:013  View
480791 44043 CVE-2010-1459 URL:http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html  View
480792 44043 CVE-2010-1459 SUSE:SUSE-SR:2010:014  View
480793 44043 CVE-2010-1459 URL:http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html  View
480794 44043 CVE-2010-1459 BID:40351  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39620 JVNDB-2010-005405 WebAsyst Shop-Script FREE における SQL インジェクションの脆弱性 WebAsyst Shop-Script FREE には、SQL インジェクションの脆弱性が存在します。 CVE-2010-1463 44043 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005405.html  View