Microsoft .Net Core vulnerabilities
34 vulnerabilities
Known vulnerabilities in Microsoft .Net Core, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-0786microsoft corporation.net framework, .net core, and powershell core+10
EPSS score3.69%
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."CVE-2018-0764microsoft corporation.net framework and .net core+13EPSS score8.88%
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.CVE-2018-0765microsoft.net_core+2EPSS score8.13%
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.CVE-2018-8409microsoftasp.net_core+5EPSS score6.56%
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.CVE-2018-8416ubuntumono+10EPSS score7.26%
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.CVE-2018-8292microsoftasp.net_core+7EPSS score14.83%
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.CVE-2018-8356microsoftasp.net_core+11EPSS score0.75%
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.CVE-2021-1721microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+133EPSS score3.34%
.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2021-26423microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+38EPSS score3.90%
.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2021-26701fedoraprojectfedora+91EPSS score30.10%
.NET Core Remote Code Execution VulnerabilityCVE-2021-31204fedoraprojectfedora+67EPSS score1.19%
.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-31957fedoraprojectfedora+69EPSS score5.14%
ASP.NET Core Denial of Service VulnerabilityCVE-2021-24112microsoftmono+9EPSS score3.45%
.NET Core Remote Code Execution VulnerabilityCVE-2021-34485microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+56EPSS score2.07%
.NET Core and Visual Studio Information Disclosure VulnerabilityCVE-2020-1147microsoftmicrosoft .net framework 2.0+132KEVEPSS score93.97%
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.CVE-2020-1108microsoftmicrosoft .net framework 2.0 service pack 2+88EPSS score6.46%
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application.
The update addresses the vulnerability by correcting how the .NET Core or .NET Framework web application handles web requests.CVE-2020-0605microsoftmicrosoft .net framework 3.0+53EPSS score17.11%
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.CVE-2020-0606microsoftmicrosoft .net framework 3.0+55EPSS score17.19%
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.CVE-2020-36846alpinebrotli+160EPSS score0.63%
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.CVE-2022-41032ubuntudotnet6+94EPSS score1.29%
NuGet Client Elevation of Privilege Vulnerability