122 matches found
Security Updates for Microsoft ASP.NET Core (February 2023)
A remote code execution vulnerability exists in ASP.NET Core 6.0 6.0.14 and ASP.NET Core 7.0 7.0.3. This vulnerability exists due to how .NET reads debugging symbols, where reading a malicious symbols file may result in remote code execution. An unauthenticated, local attacker can exploit this, t...
Security Updates for Microsoft ASP.NET Core (December 2022)
A remote code execution vulnerability exists in ASP.NET core 3.1, ASP.NET 6.0, and ASP.NET 7.0, where a malicious actor could cause a user to run arbitrary code as a result of parsing maliciously crafted xps files. Note that Nessus has not tested for this issue but has instead relied only on the...
.NET Core Remote Code Execution Vulnerability - Windows
.NET Core is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Denial of Service (DoS)
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS when the Kestrel web serve...
Security Bulletin: IBM Robotic Process Automation may be vulnerable to denial of service due to microsoft.owin.security.cookies (CVE-2022-29117)
Summary microsoft.owin.security.cookies is used by IBM Robotic Process Automation as part of Miscrosoft ASP.NET. CVE-2022-29117 Vulnerability Details CVEID:CVE-2022-29117 DESCRIPTION: Microsoft ASP.NET and Visual Studio are vulnerable to a denial of service. By sending a specially-crafted request...
Security Updates for Microsoft ASP.NET Core (September 2022)
A denial of service vulnerability exists in ASP.NET core 6.0 6.0.9 and ASP.NET Core 3.1 3.1.29. An unauthenticated, remote attacker can exploit this, by sending a customized payload that is parsed during model binding, to cause a stack overflow, which may cause the application to stop responding...
Cookie parsing failure
A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.The security update addresses...
Security Bulletin: Multiple Vulnerabilities may affect IBM Robotic Process Automation
Summary Security Bulletin: Multiple Vulnerabilities may affect IBM Robotic Process Automation Vulnerability Details CVEID: CVE-2017-0247 DESCRIPTION: Microsoft ASP.NET Core is vulnerable to a denial of service, caused by improper validation of web requests in the TextEncoder.EncodeCore function. ...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
CVE-2021-43853
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
CVE-2021-43853
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
Cross site scripting
Ajax.NET Professional AjaxPro is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation...
CVE-2021-43853
Ajax.NET Professional (AjaxPro) for Microsoft ASP.NET is affected by CVE-2021-43853 due to a JavaScript object injection vulnerability that arises during JSON input parsing, enabling cross-site scripting if a malicious actor supplies crafted data. All releases before 21.12.22.1 are affected. A re...
Security Updates for Microsoft ASP.NET Core (December 2021)
The Microsoft ASP.NET Core installations on the remote host are missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. Note that Nessus has not tested for this issue but has instead relied only on...
Security Update for Microsoft ASP.NET Core (August 2021)
The Microsoft ASP.NET Core installation on the remote host is version 2.1.x prior to 2.1.29, 3.1.x prior to 3.1.18, or 5.x prior to 5.0.9. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected...
Security Update for Microsoft ASP.NET Core (February 2021)
The Microsoft ASP.NET Core installation on the remote host is version 2.1.x prior to 2.1.25, 3.1.x prior to 3.1.126, or 5.x prior to 5.0.3. It is, therefore, affected by a denial of service vulnerability when creating HTTPS web requests during X509 certificate chain building. An unauthenticated,...
Security fix for the ALT Linux 10 package dotnet-bootstrap-3.1 version 3.1.11-alt1
Jan. 28, 2021 Vitaly Lipatov 3.1.11-alt1 - new version 3.1.11 with rpmgs script - .NET Core 3.1.11 - January 12, 2021 - CVE-2021-1723: ASP.NET Core Denial of Service Vulnerability - CVE-2020-1045: Microsoft ASP.NET Core Security Feature Bypass Vulnerability - CVE-2020-1597: NET Core Remote Code...
Security fix for the ALT Linux 9 package dotnet-bootstrap-3.1 version 3.1.11-alt1
Jan. 28, 2021 Vitaly Lipatov 3.1.11-alt1 - new version 3.1.11 with rpmgs script - .NET Core 3.1.11 - January 12, 2021 - CVE-2021-1723: ASP.NET Core Denial of Service Vulnerability - CVE-2020-1045: Microsoft ASP.NET Core Security Feature Bypass Vulnerability - CVE-2020-1597: NET Core Remote Code...
Security Update for Microsoft ASP.NET Core (January 2021)
The Microsoft ASP.NET Core installation on the remote host is version 3.1.x 3.1.11 or 5.x prior to 5.0.2. It is, therefore, affected by a denial of service DoS vulnerability in the way Kestrel parses HTTP/2 requests. An unauthenticated, remote attacker can exploit this issue, by sending a special...
