.NET 5.0 security and bugfix update

An update is available for dotnet5.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

Important: .NET 5.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.211 and .NET Runtime 5.0.14...

ALSA-2022:0495 Important: .NET 5.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 5.0.211 and .NET Runtime 5.0.14...

Rocky Linux 8 : .NET Core 3.1 (RLSA-2021:3142)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3142 advisory. - .NET Core and Visual Studio Denial of Service Vulnerability CVE-2021-26423 - .NET Core and Visual Studio Information Disclosure Vulnerability...

CVE-2022-219862

A vulnerability was found in dotnet’s ASP.NET Core Krestel when pooling HTTP/2 and HTTP/3 headers. This flaw allows a remote, unauthenticated attacker to cause a denial of service...

Kestrel Web Server 输入验证错误漏洞

Kestrel Web Server is a cross-platform web server for ASP.NET Core. An input validation error vulnerability exists in Kestrel Web Server. The following products and releases are affected:Microsoft Visual Studio 2019 version 16.9 includes 16.0 - 16.8,Microsoft Visual Studio 2019 version 16.11...

Information disclosure

Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This...

CVE-2021-40340 OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product

Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This...

CVE-2021-40340

Hitachi Energy LinkOne WebView (v3.20–v3.26) exhibits an Information Exposure vulnerability (CVE-2021-40340) caused by ASP server misconfiguration that reveals server and ASP.NET details. Exploitation can enable reconnaissance for further attacks; impact is limited to information disclosure rathe...

Kentico Cross-Site Scripting Vulnerability (CNVD-2022-03949)

A cross-site scripting vulnerability exists in Kentico Xperience, an ASP.NET-based content management system CMS from Kentico U.S. The vulnerability stems from the fact that the product's media subsystem does not validate input data. An attacker could cause client-side code execution via XML...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2021-2927)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-40340

Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This...

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

Cross site scripting

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853 Cross-Site Scripting in AjaxNetProfessional

Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...

CVE-2021-43853

Ajax.NET Professional (AjaxPro) for Microsoft ASP.NET is affected by CVE-2021-43853 due to a JavaScript object injection vulnerability that arises during JSON input parsing, enabling cross-site scripting if a malicious actor supplies crafted data. All releases before 21.12.22.1 are affected. A re...

CVE-2021-44029

An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known due...

CVE-2021-44029

An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known due...