Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the SocketsHttpHandler process. An attacker can obtain sensitive proxy credentials by causing an HTTP redirect that results in the Proxy-Authorization header being sent to an...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the ReceiveFromAsync process when a SocketAsyncEventArgs instance is reused across IPv4 and IPv6 datagram sockets, which can retain an undersized cached native address buffer. An attacker can achieve remote code...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the processing of signed XML data due to inefficient algorithmic complexity in the System.Security.Cryptography.Xml and System.Private.Xml components. An attacker can cause excessive resource...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the DateTime Hebrew-number parsing process. An attacker can cause the application to terminate unexpectedly by providing specially crafted input that leads to reading outside the expected stack bounds. Remediation...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the processing of XML data in cryptographic operations. An attacker can cause excessive resource consumption and application unavailability by submitting specially crafted XML input that triggers...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via XML encryption processing. An attacker can cause denial of service by supplying a crafted XML document that triggers excessive resource consumption or causes the application to...