Orchard is a free, open source, community-focused project aimed at delivering applications and reusable components on the ASP.NET platform.
Orchard will create shared components for building ASP.NET applications and extensions, and specific applications that leverage these components to meet the needs of end-users, designers, developers, and Web professionals. Additionally, we seek to create partnerships with existing application authors to help them achieve their goals. Orchard is delivered as part of the ASP.NET Open Source Gallery under the Outercurve Foundation. It is licensed under a New BSD license, which is approved by the OSI.
More
此安全更新解决了 ASP.NET MVC 中一个公开披露的漏洞。如果攻击者诱使用户单击特制链接或访问包含旨在利用漏洞的特制内容的网页，则此漏洞可能允许绕过安全功能。在基于 Web 的攻击情形中，攻击者可能拥有一个旨在通过 Web 浏览器利用漏洞的特制网站，然后诱使用户查看该网站。攻击者还可能利用受到破坏的网站以及接受或宿主用户提供的内容或广告的网站。这些网站可能包含可以利用此漏洞的特制内容。但是在所有情况下，攻击者无法强制用户查看由攻击者控制的内容。相反，攻击者必须诱使用户采取行动，方法通常是让用户单击电子邮件或 Instant Messenger 消息中的链接以使用户链接到攻击者的网站，或者让用户打开通过电子邮件发送的附件。