EUVD-2025-20507

Malicious code in bioql PyPI...

EUVD-2023-2860

Malicious code in bioql PyPI...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via the DiaSymReader.dll process. An attacker can execute arbitrary code by exploiting a buffer over-read condition when the application processes specially crafted input. This issue affects EOL ASP.NET 6.0.0 = 6.0.36 a...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.osx-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code execution...

CVE-2025-36854

CVE-2025-36854 concerns an RCE in EOL ASP.NET caused by a race condition when closing an HTTP/3 stream while response data is still being written, leading to use-after-free. Affected are EOL ASP.NET 6.0.0–6.0.36, 8.0.0–8.0.8, and 9.0.0-preview.1.24081.5–9.0.0.RC.1; self-contained deployments are ...

PT-2025-36468

Name of the Vulnerable Software and Affected Versions: EOL ASP.NET versions 6.0.0 through 6.0.36 EOL ASP.NET versions 8.0.0 through 8.0.8 EOL ASP.NET versions 9.0.0-preview.1.24081.5 through 9.0.0.RC.1 Description: A race condition may occur when closing an HTTP/3 stream while application code is...

CVE-2025-36854: Use After Free

A vulnerability CVE-2024-38229 https://www.cve.org/CVERecord exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free...

CVE-2025-36855: Buffer Over-read

A vulnerability CVE-2025-21176 https://www.cve.org/CVERecord exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or...

Exploit for Use of Hard-coded Cryptographic Key in Gladinet Centrestack

CVE-2025-30406 ViewState Exploit PoC Overview This is a Pr...

.NET Bounty Program now offers up to $40,000 in awards

We’re excited to announce significant updates to the Microsoft .NET Bounty Program. These changes expand the program’s scope, simplify the award structure, and offer great incentives for security researchers. The .NET Bounty Program now offers awards up to $40,000 USD for vulnerabilities impactin...

CVE-2025-54425

CVE-2025-54425 affects Umbraco’s Delivery API. When public access is restricted by an API key header and output caching is enabled, the cache does not vary by the API key header, potentially returning cached responses to users without a valid API key if a prior request with a valid key occurred. ...

BIT-ASPNET-CORE-2025-26682 ASP.NET Core and Visual Studio Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Gold Melody IAB Exploits Exposed ASP.NET Machine Keys for Unauthorized Access to Targets

The Initial Access Broker IAB known as Gold Melody has been attributed to a campaign that exploits leaked ASP.NET machine keys to obtain unauthorized access to organizations and peddle that access to other threat actors. The activity is being tracked by Palo Alto Networks Unit 42 under the monike...

CVE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

...

CVE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability

...

PT-2025-28469 · Microsoft · Asp.Net Core

Name of the Vulnerable Software and Affected Versions: ASP.NET Core affected versions not specified Description: The issue concerns weak authentication in End Of Life EOL ASP.NET Core, allowing an unauthorized attacker to elevate privileges over a network. It affects only EOL software components...

CVE-2025-7326: Weak Authentication

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...

BIT-ASPNET-CORE-2025-24070 ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network...

Progress多款产品 跨站脚本漏洞

Progress Telerik UI for ASP.NET Core and others are products of Progress, Inc.Progress Telerik UI for ASP.NET Core is a set of UI component libraries for building cross-platform responsive web applications.Progress Telerik UI for Progress Telerik UI for ASP.NET MVC is a library of UI components f...

TencentOS Server 4: dotnet6.0 (TSSA-2024:0467)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0467 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...