KLA11172 Multiple vulnerabilities in Microsoft Development Tools

Multiple serious vulnerabilities have been found in Microsoft .NET Core, ASP.NET Core, Microsoft Excel and Microsoft Office Compatibility Pack. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, bypass security restrictions and gain privileges...

Microsoft ASP.NET Core CVE-2018-0785 Cross Site Request Forgery Vulnerability

Description Microsoft ASP.NET Core is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft ASP.NET Core...

Microsoft ASP.NET Core CVE-2018-0784 Remote Privilege Escalation Vulnerability

Description Microsoft ASP.NET Core is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft ASP.NET Microsoft ASP.NET Core 2.0 Microsoft Windows 10 version 1703 for 32-bit Systems Recommendations Block...

Microsoft ASP.NET Core Denial of Service Vulnerability

This host is missing an important security update according to Microsoft advisory CVE-2017-11883. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Microsoft ASP.NET Core Elevation Of Privilege Vulnerability

This host is missing an important security update according to Microsoft advisory CVE-2017-11879. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of November 13, 2017

The dreaded white, blank screen in Microsoft Word is taunting me, with its blinking cursor asking for words to be written. Just when I thought I wouldn’t get any inspiration for this week’s blog, inspiration came to me from beyond through our late CTO Raimund Genes. Earlier this week, the third...

Microsoft ASP.NET Core Information Disclosure Vulnerability

This host is missing an important security update according to Microsoft advisory CVE-2017-8700. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Microsoft ASP.NET Core Denial of Service Vulnerability (CNVD-2017-37113)

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web One applications, IoT applications, and mobile backends. A denial of service vulnerability exists in Microsoft ASP.NET Core versions 1.0, 1.1, and...

KLA11133 Multiple vulnerabilities in Microsoft Development Tools

Multiple vulnerabilities were found in Microsoft Development Tools. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in ASP.NET Core can be...

CVE-2017-8700

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing CORS configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability"...

CVE-2017-8700

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing CORS configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability"...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

Privilege escalation

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

Information disclosure

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing CORS configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability"...

CVE-2017-8700

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing CORS configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability"...

CVE-2017-8700

CVE-2017-8700 is an information-disclosure vulnerability in ASP.NET Core (versions 1.0, 1.1, 2.0) where CORS configuration can be bypassed, potentially allowing access to normally restricted content. Affected stack includes ASP.NET Core and .NET Core 1.0/1.1/2.0. The root cause is improper CORS h...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

CVE-2017-11879

CVE-2017-11879 affects ASP.NET Core 2.0. The vulnerability allows an attacker to steal login session information (cookies or authentication tokens) via a specially crafted URL, described as an Elevation of Privilege in ASP.NET Core. The affected component is ASP.NET Core 2.0 runtime; root cause i...

ASP.NET Core Information Disclosure Vulnerability

An information disclosure vulnerability exists in ASP.NET Core that allows bypassing Cross-origin Resource Sharing CORS configurations. An attacker who successfully exploited the vulnerability could retrieve content, that is normally restricted, from a web application. The security update address...