Microsoft Corporation Asp.Net Core vulnerabilities
9 vulnerabilities
Known vulnerabilities in Microsoft Corporation Asp.Net Core, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-0784microsoft corporationasp.net core+1
EPSS score6.50%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0808.CVE-2018-0785microsoft corporationasp.net core+1EPSS score3.03%
ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery Vulnerability".CVE-2018-0787microsoft corporationasp.net core+3EPSS score9.57%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".CVE-2018-0808microsoft corporationasp.net core+1EPSS score7.76%
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784.CVE-2017-11879microsoft corporationasp.net core+3EPSS score9.40%
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".CVE-2017-0249microsoft corporationasp.net core+38EPSS score4.25%
An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.CVE-2017-0247microsoft corporationasp.net core+37EPSS score16.91%
A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.CVE-2017-0256microsoft corporationasp.net core+37EPSS score3.54%
A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.CVE-2017-8700microsoft corporationasp.net core+3EPSS score10.48%
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".