CVE-2023-36038

ASP.NET Core Denial of Service Vulnerability...

KLA61979 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege...

CVE-2023-36560: Undefined Security Weakness

ASP.NET Security Feature Bypass Vulnerability...

CVE-2023-36558: Undefined Security Weakness

ASP.NET Core Security Feature Bypass Vulnerability...

Microsoft ASP.NET Core Security Vulnerability

Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. A security vulnerability exists in Microsoft ASP.NET Core. An...

CVE-2023-36038: Uncontrolled Resource Consumption

ASP.NET Core Denial of Service Vulnerability...

SUSE CVE-2020-1161

unknown...

Security Update for Microsoft .NET 6 Core (October 2023)

The version of Microsoft .NET 6 Core installed on the remote host is prior to 6.0.23. It is, therefore, affected by a vulnerability as referenced in the 2023Oct10 advisory. - A vulnerability exists in the ASP.NET Core Kestrel web server where a malicious client may flood the server with specially...

Security Updates for Microsoft ASP.NET Core (October 2023)

The version of ASP.NET core installed on the remote host is affected by a denial of service DoS vulnerability. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October...

.NET Core HTTP2 Rapid Reset Attack DoS Vulnerability - Windows

.NET Core is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore";...

Security Update for .NET Core SDK (October 2023)

The version of Microsoft .NET Core SDK installed on the remote host is 6.0.x prior to 6.0.123, 6.0.x prior to 6.0.318, 6.0.x prior to 6.0.414, 7.0.x prior to 7.0.112 or 7.0.x prior to 7.0.309 or 7.0.x prior to 7.0.402. It is, therefore, affected by multiple vulnerabilities, as follows: - A...

.NET Core Multiple DoS Vulnerabilities - Windows

.NET Core is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Patch Tuesday - October 2023

Microsoft is addressing 105 vulnerabilities this October Patch Tuesday, including three zero-day vulnerabilities, as well as 12 critical remote code execution RCE vulnerabilities, and one republished third-party vulnerability. WordPad: zero-day NTLM hash disclosure Another Patch Tuesday, another...

KLA61353 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in HTTP/2 protocol can be exploited remotely to cause...

Security Bulletin: A vulnerability in Microsoft ASP.NET Core may affect IBM Robotic Process Automation and result in an exposure of sensitive information (CVE-2023-35391).

Summary There is a vulnerability in Microsoft ASP.NET Core used by IBM Robotic Process Automation as part of it's infrastructure, which may allow a remote authenticated attacker to obtain sensitive information. CVE-2023-35391. This bulletin identifies the security fixes to apply to address this...

CVE-2023-41890

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...

Authentication flaw

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...

CVE-2023-41890 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...

CVE-2023-41890 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...

CVE-2023-41890

Sustainsys.Saml2 (used to add SAML2P to ASP.NET sites) contains CVE-2023-41890 due to insufficient validation of the IdP issuer when processing a response. This can let a malicious IdP craft a SAML2 response that appears to come from another IdP, and an end user could cause stored AuthenticationP...