ASP.NET Core allow an elevation of privilege

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

GHSA-365P-96QV-XR7G ASP.NET Core allow an elevation of privilege

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

GHSA-VHVH-528Q-FF3P Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2...

Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2...

GHSA-J378-6MMW-HQFR Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1...

.NET Core Information Disclosure Vulnerability (Oct 2018) - Windows

.NET Core is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-17060

Telerik Extensions for ASP.NET MVC all versions does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013...

Code injection

Telerik Extensions for ASP.NET MVC all versions does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013...

CVE-2018-17060

Telerik Extensions for ASP.NET MVC all versions does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013...

CVE-2018-17060

The CVE refers to Telerik Extensions for ASP.NET MVC (all versions), which reportedly does not whitelist requests, enabling a remote attacker to access files inside the server’s web directory. The affected product is obsolete since June 2013. Connected advisories corroborate an improper access-co...

DNN (DotNetNuke) 5.0.0 < 9.2.2 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 5.0.0 or later but prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities including a leaked cryptographic information vulnerability and a cross-site scripting vulnerability. An authenticated attacker...

CVE-2018-16958

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NETSessionID primary session cookie, when Internet Information Services IIS with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is...

Buffer overflow

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NETSessionID primary session cookie, when Internet Information Services IIS with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is...

CVE-2018-16958

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The ASP.NETSessionID primary session cookie, when Internet Information Services IIS with ASP.NET is used, is not protected with the HttpOnly attribute. The attribute cannot be enabled by customers. Consequently, this cookie is...

CVE-2018-8409

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1...

ASP.NET Core SDK 'System.IO.Pipelines' Denial of Service Vulnerability (Sep 2018) - Windows

ASP.NET Core SDK is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ASP.NET Core 'System.IO.Pipelines' Denial of Service Vulnerability (Sep 2018) - Windows

ASP.NET Core is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore...

CVE-2018-8409

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1...

EUVD-2018-0622

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1...

CVE-2018-8409

The CVE-2018-8409 entry concerns a Denial of Service affecting System.IO.Pipelines used with .NET Core 2.1 / ASP.NET Core 2.1. The vulnerability occurs when System.IO.Pipelines improperly handles requests, leading to partial availability impact. The connected documents confirm the affected compon...