CVE-2023-35391: Undefined Security Weakness

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability...

Microsoft ASP.NET Core and Visual Studio Security Vulnerabilities

Microsoft Visual Studio and Microsoft ASP.NET Core are both products of Microsoft Corporation, USA. Microsoft Visual Studio is a family of development tool suites and a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. Microsoft ASP.NET...

Fedora 38 : dotnet6.0 (2023-feda45bc39)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-feda45bc39 advisory. This is the July 2023 update for .NET 6. It updates the SDK to 6.0.120 and Runtime to 6.0.20. https://github.com/dotnet/announcements/issues/262...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-242 advisory. .NET Denial of Service Vulnerability. CVE-2023-21538 .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2023-24895 .NET, .NET Framework, and Visual Studio Elevation...

Oracle Linux 9 : .NET / 7.0 (ELSA-2023-4057)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4057 advisory. 7.0.109-1.0.1 - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier Orabug: 34671152 7.0.109-1 - Update to .NET SDK 7.0.109 and...

Oracle Linux 8 : .NET / 7.0 (ELSA-2023-4058)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4058 advisory. 7.0.109-1.0.1 - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier Orabug: 34671152 7.0.109-1 - Update to .NET SDK 7.0.109 and...

Oracle Linux 8 : .NET / 6.0 (ELSA-2023-4059)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4059 advisory. 6.0.120-1.0.1 - Add missing Oracle Linux Runtime IDs 6.0.120-1 - Update to .NET SDK 6.0.120 and Runtime 6.0.20 - Resolves: RHBZ2219637 Tenable has extracted the...

Oracle Linux 9 : .NET / 6.0 (ELSA-2023-4060)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4060 advisory. 6.0.120-1.0.1 - Add missing Oracle Linux Runtime IDs 6.0.120-1 - Update to .NET SDK 6.0.120 and Runtime 6.0.20 - Resolves: RHBZ2219637 Tenable has extracted the...

AlmaLinux 8 : .NET 6.0 (ALSA-2023:4059)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4059 advisory. - ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Note that Nessus has not tested for this issue but has instead relied only on the...

AlmaLinux 8 : .NET 7.0 (ALSA-2023:4058)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4058 advisory. - ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Note that Nessus has not tested for this issue but has instead relied only on the...

AlmaLinux 9 : .NET 7.0 (ALSA-2023:4057)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4057 advisory. - ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2023-37267

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1...

Input validation

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1...

CVE-2023-37267

Umbraco CMS (ASP.NET) has a vulnerability where, under rare conditions during a restart, unauthorized users can gain admin-level backoffice permissions. The issue is mitigated by upgrading Umbraco to patched releases 10.6.1, 11.4.2, or 12.0.1 (or higher). Several sources (including CVE records an...

CVE-2023-37267 Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1...

CVE-2023-37267 Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1...

CVE-2023-37267 Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1...

.NET Core Multiple Vulnerabilities (KB5028705, KB5028706) - Windows

.NET Core prone to security feature bypass and elevation of privilege vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Updates for Microsoft ASP.NET Core (July 2023)

Multiple vulnerabilities exist in ASP.NET Core 6.0 6.0.20 and ASP.NET Core 7.0 7.0.9. - A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve cross-session/cross-user elevation of privilege EoP and code execution. CVE-2023-33127 - A vulnerability exis...

Ubuntu 22.04 LTS / 23.04 : .NET vulnerability (USN-6217-1)

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6217-1 advisory. McKee-Harris, Matt Cotterell, and Jack Moran discovered that .NET did not properly update account lockout maximum failed attempts. An attacker could...