Security feature bypass

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. The security update address...

CVE-2020-1460

CVE-2020-1460 is a Microsoft SharePoint Server Remote Code Execution vulnerability. The issue occurs when SharePoint Server fails to properly identify and filter unsafe ASP.Net web controls; an authenticated attacker can craft and invoke a malicious page to execute actions in the SharePoint appli...

Code injection

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages...

CVE-2020-25258

CVE-2020-25258 (Hyland OnBase) affects OnBase versions 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below, and 20.3.10.1000 and below. The issue arises from using ASP.NET BinaryFormatter.Deserialize in SOAP messages, enabling an attacker to transmit and execute...

CVE-2020-25258

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages...

Security Updates for Microsoft SharePoint Server (September 2020)

The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package...

CVE-2020-1045 Microsoft ASP.NET Core Security Feature Bypass Vulnerability

...

CVE-2020-1045

CVE-2020-1045 is a Security Feature Bypass in Microsoft ASP.NET Core where the cookie parser decodes entire cookie strings, allowing a attacker to set a second cookie with a percent-encoded name. Documented impact is a bypass of security controls via crafted encoded cookie names; CVSS v3.1 base s...

CVE-2020-1045 Microsoft ASP.NET Core Security Feature Bypass Vulnerability

...

CVE-2020-1045: Undefined Security Weakness

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. The security update address...

CVE-2020-1460: Undefined Security Weakness

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security conte...

CVE-2020-25258: Deserialization of Untrusted Data

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages...

.NET Core Security Feature Bypass Vulnerability (Sep 2020)

ASP.NET Core is prone to a security feature bypass vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

.NET Core SDK Security Feature Bypass Vulnerability (Sep 2020)

ASP.NET Core SDK is prone to a security feature bypass vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Important: Red Hat Security Advisory: .NET Core 3.1 security and bugfix update

An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: .NET Core 3.1 security and bugfix update for Red Hat Enterprise Linux

An update for rh-dotnet31-dotnet is now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Microsoft SharePoint Server Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security conte...

Microsoft ASP.NET Core Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names. The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded. The security update address...

KLA11956 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Diagnostics Hub...

Security Update for Microsoft ASP.NET Core (September 2020)

The Microsoft ASP.NET Core installation on the remote host is version 2.1.x 2.1.22, or 3.1.x 3.1.8. It is, therefore, affected by a security feature bypass vulnerability in the way ASP.NET Core parses encoded cookie names. An unauthenticated, remote attacker can exploit this issue, by sending a...