Patch Tuesday - August 2023

Microsoft is addressing 86 vulnerabilities this August Patch Tuesday, including one zero-day vulnerability, as well as five critical remote code execution RCE vulnerabilities, and 12 browser vulnerabilities. An unpatched zero-day malicious document vulnerability from July also receives Windows OS...

CVE-2023-36899

ASP.NET Elevation of Privilege Vulnerability...

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

Privilege escalation

ASP.NET Elevation of Privilege Vulnerability...

Information disclosure

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

CVE-2023-35391

CVE-2023-35391 affects Microsoft ASP.NET Core SignalR and Visual Studio, exposing sensitive information through the ASP.NET Core SignalR backplane (e.g., Redis backplane) in affected .NET/ASP.NET Core deployments. Connected sources specify that exploitation involves information disclosure via Sig...

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

CVE-2023-35391 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

...

CVE-2023-35391 ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

...

CVE-2023-36899 ASP.NET Elevation of Privilege Vulnerability

...

CVE-2023-36899 ASP.NET Elevation of Privilege Vulnerability

...

CVE-2023-36899

CVE-2023-36899 is described as a .NET Framework/ASP.NET elevation of privilege issue linked to IIS and cookieless sessions. The connected exploit writeups show an IIS environment where the 1cookieless1 feature can be abused to bypass authentication and access protected resources by crafting URL...

CVE-2023-38178

A vulnerability was found in dotNET in Kestrel component. This issue may allow a malicious client to bypass the QUIC stream limit in both ASP.NET and .NET runtimes in HTTP/3, resulting in a denial of service...

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

...

ASP.NET Elevation of Privilege Vulnerability

...

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in several Developer tools. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Spoofing Access to sensitive data...

CVE-2023-36899: Improper Input Validation

ASP.NET Elevation of Privilege Vulnerability...

Microsoft ASP.NET Core Security Vulnerability

Microsoft ASP.NET Core is a framework of cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web applications, Internet of Things applications, and mobile backends. ASP.NET has a security vulnerability. An attacker could exploit the...