Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12505
HistoryApr 12, 2022 - 12:00 a.m.

KLA12505 Multiple vulnerabilities in Microsoft Developer Tools

2022-04-1200:00:00
Kaspersky Lab
threats.kaspersky.com
39

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

57.2%

JSON

Detect date:

04/12/2022

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service.

Affected products:

Microsoft .NET Framework 4.5.2
Microsoft .NET Framework 4.8
Microsoft .NET Framework 3.5 AND 4.8
Microsoft .NET Framework 3.5 AND 4.7.2
PowerShell 7.1
PowerShell 7.0
PowerShell 7.2
YARP 1.0
YARP 1.1RC

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2022-24513
CVE-2022-24767
CVE-2022-26832
CVE-2022-26921
CVE-2022-24765
CVE-2022-26924
CVE-2022-26788

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2022-267887.8Critical
CVE-2022-245137.8Critical
CVE-2022-247677.8Critical
CVE-2022-268327.5Critical
CVE-2022-269217.3High
CVE-2022-247657.8Critical
CVE-2022-269247.5Critical

KB list:

5012596
5012117
5012326
5012332
5012327
5012331
5012329
5012324
5012328
5012325
5012123
5012121
5012120
5012118
5012330
5016568

Microsoft official advisories:

References

Related

nessus 38
github 2
redos 1
osv 7
prion 8
cnvd 3
cve 7
mscve 7
mskb 15
openvas 61
redhatcve 2
zdi 1
altlinux 1
suse 5
slackware 1
mageia 1
ubuntu 3
photon 2
fedora 23
debiancve 2
archlinux 1
veracode 1
alpinelinux 1
amazon 2
ubuntucve 2
ibm 1
freebsd 1
nessus
nessus
Security Updates for Microsoft Visual Studio Products (April 2022)
2022-04-14 00:00:00
Security Updates for Microsoft .NET Framework (April 2022)
2022-12-05 00:00:00
Security Update for Microsoft Visual Studio Code (April 2022)
2022-04-15 00:00:00
github
github
Git security vulnerability announced
2022-04-12 17:51:41
YARP Denial of Service Vulnerability
2022-04-22 20:23:44
redos
redos
ROS-20220516-05
2022-05-16 00:00:00
osv
osv
CVE-2022-24767
2022-04-12 18:15:09
CVE-2022-26924
2022-04-15 19:15:15
YARP Denial of Service Vulnerability
2022-04-22 20:23:44
prion
prion
Code injection
2022-04-12 18:15:00
Denial of service
2022-04-15 19:15:00
Privilege escalation
2022-04-15 19:15:00
cnvd
cnvd
Microsoft Visual Studio Code Elevation of Privilege Vulnerability
2022-04-14 00:00:00
Microsoft .NET Framework Denial of Service Vulnerability (CNVD-2022-60136)
2022-04-15 00:00:00
Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2022-60135)
2022-04-15 00:00:00
cve
cve
CVE-2022-26924
2022-04-15 19:15:00
CVE-2022-24767
2022-04-12 18:15:00
CVE-2022-26921
2022-04-15 19:15:00
mscve
mscve
YARP Denial of Service Vulnerability
2022-04-12 08:00:00
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account
2022-04-12 07:00:00
Visual Studio Code Elevation of Privilege Vulnerability
2022-04-12 08:00:00
mskb
mskb
April 12, 2022-KB5012123 Cumulative Update for .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2
2022-04-12 08:00:00
Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB5012325)
2022-04-12 08:00:00
July 12, 2022-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1, RT 8.1, and Windows Server 2012 R2 (KB5016568)
2022-04-12 08:00:00
openvas
openvas
Microsoft .NET Framework DoS Vulnerability (KB5012331)
2022-04-13 00:00:00
Microsoft .NET Framework DoS Vulnerability (KB5012117)
2022-04-13 00:00:00
Microsoft .NET Framework DoS Vulnerability (KB5012120)
2022-04-13 00:00:00
redhatcve
redhatcve
CVE-2022-26832
2022-04-20 18:14:38
CVE-2022-24765
2022-04-13 06:27:14
zdi
zdi
Microsoft Visual Studio VSIX Auto Update Deserialization of Untrusted Data Privilege Escalation Vulnerability
2022-06-01 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package git version 2.33.2-alt1
2022-04-19 00:00:00
suse
suse
Security update for git (important)
2022-05-02 00:00:00
Security update for git (important)
2022-04-19 00:00:00
Security update for libgit2 (important)
2022-10-04 00:00:00
slackware
slackware
[slackware-security] git
2022-04-14 21:20:42
mageia
mageia
Updated git packages fix security vulnerability
2022-04-22 20:07:29
ubuntu
ubuntu
Git vulnerability
2022-04-12 00:00:00
Git vulnerability
2022-04-25 00:00:00
Git vulnerabilities
2022-07-13 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0184
2022-05-17 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0184
2022-05-17 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: git-2.35.3-1.fc35
2022-05-08 01:48:33
[SECURITY] Fedora 36 Update: git-2.36.0-1.fc36
2022-05-08 01:06:35
[SECURITY] Fedora 34 Update: git-2.34.3-1.fc34
2022-05-08 02:03:43
debiancve
debiancve
CVE-2022-24765
2022-04-12 18:15:00
CVE-2022-29187
2022-07-12 21:15:00
archlinux
archlinux
[ASA-202205-2] git: arbitrary command execution
2022-05-16 00:00:00
veracode
veracode
Privilege Escalation
2022-04-13 15:23:21
alpinelinux
alpinelinux
CVE-2022-24765
2022-04-12 18:15:00
amazon
amazon
Medium: git
2022-07-06 03:10:00
Medium: git
2022-05-31 23:47:00
ubuntucve
ubuntucve
CVE-2022-24765
2022-04-12 00:00:00
CVE-2022-29187
2022-07-12 00:00:00
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in MS Visual Studio (CVE-2022-24765).
2023-01-12 21:59:00
freebsd
freebsd
git -- privilege escalation
2022-07-12 00:00:00

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

57.2%

JSON
Related for KLA12505
nessus38github2redos1osv7prion8cnvd3cve7mscve7mskb15openvas61redhatcve2zdi1altlinux1suse5slackware1mageia1ubuntu3photon2fedora23debiancve2archlinux1veracode1alpinelinux1amazon2ubuntucve2ibm1freebsd1