CVE-2023-41890: Authentication Bypass by Alternate Name

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...

Security Bulletin: Vulnerabilities in Microsoft .NET Core and Microsoft ASP.NET may affect IBM Robotic Process Automation for Cloud Pak

Summary Microsoft .NET Core is used by IBM Robotic Process Automation for Cloud Pak as part its runtime CVE-2023-35390. Microsoft ASP.NET is used by IBM Robotic Process Automation for Cloud Pak as part of its runtime CVE-2023-38180. Vulnerability Details CVEID:CVE-2023-35390 DESCRIPTION: Microsof...

Security Bulletin: A vulnerability in Microsoft ASP.NET affects IBM Robotic Process Automation and may result in a denial of service (CVE-2022-29117)

Summary Microsoft ASP.NET is used by IBM Robotic Process Automation as part of the application framework. CVE-2022-29117 Vulnerability Details CVEID:CVE-2022-29117 DESCRIPTION: Microsoft ASP.NET and Visual Studio are vulnerable to a denial of service. By sending a specially-crafted request, a...

Rocky Linux 8 : .NET 6.0 (RLSA-2023:4059)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:4059 advisory. - ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Note that Nessus has not tested for this issue but has instead relied only on th...

Important: dotnet6.0

Issue Overview: ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-302 --releasever 2023.1.20230825 to update your system. More...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-302)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-302 advisory. ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...

GHSA-J8RM-CM55-QQJ6 .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2023-35391: .NET Information Disclosure Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET core 2.1, .NET 6.0 and, .NET 7.0. This advisory also provides guidance on what developers c...

.NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2023-35391: .NET Information Disclosure Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET core 2.1, .NET 6.0 and, .NET 7.0. This advisory also provides guidance on what developers c...

Information Disclosure

ASP.NET Core SignalR and Visual Studio is vulnerable to Information Disclosure. This vulnerability occurs when a user sends a specially crafted message to a SignalR hub. If the message is valid, the user can obtain sensitive information, such as the names of other users in the hub...

CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a recently patched security flaw in Microsoft's .NET and Visual Studio products to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Tracked as CVE-2023-38180 CVSS score: 7.5, the...

Security Updates for Microsoft Visual Studio Products (August 2023)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - .NET Core and Visual Studio Denial of Service Vulnerability. CVE-2023-38178 - .NET and Visual Studio Remote Code Execution Vulnerability. CVE-2023-35390 - .NET and Visual...

Denial Of Service (DoS)

.NET and ASP.NET are vulnerable to Denial Of Service DoS. The vulnerability exists in the Kestrel web server, which allows an attacker to bypass the QUIC stream limit in HTTP/3, resulting in an application crash...

Denial Of Service (DoS)

ASP.NET and .NET are vulnerable to Denial of Service. The vulnerability is due to the Kestrel web server detecting a malicious client but failing to disconnect, resulting in Denial of Service...

.NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38178: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to...

GHSA-VMCH-3W2X-VHGQ .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do...

.NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38180: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1, .NET 6.0, and .NET 7.0. This advisory also provides guidance on what developers can do...

Microsoft .NET Framework Multiple Vulnerabilities (KB5029654)

This host is missing an important security update according to Microsoft KB5029654 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft .NET Framework Multiple Vulnerabilities (KB5029655)

This host is missing an important security update according to Microsoft KB5029655 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft .NET Framework Multiple Vulnerabilities (KB5029647)

This host is missing a critical security update according to Microsoft KB5029647 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft .NET Framework Multiple Vulnerabilities (KB5028948)

This host is missing an important security update according to Microsoft KB5028948 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...