CVE-2025-30399

CVE-2025-30399 is a Remote Code Execution vulnerability described as an untrusted search path in .NET and Visual Studio that allows an attacker to execute code over the network by placing files in specific locations. Connected advisories confirm affected runtimes and provide fixes: .NET 8.x runti...

CVE-2025-30399 .NET and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-30399

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network...

AlmaLinux 9 : .NET 8.0 (ALSA-2025:8813)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8813 advisory. dotnet: .NET Remote Code Vulnerability CVE-2025-30399 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note tha...

Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : .NET vulnerability (USN-7563-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7563-1 advisory. It was discovered that .NET did not properly validate search path in Microsoft.NETCore.App.Runtime. An attacker could possibly use thi...

.NET 9.0 security update

9.0.107-1.0.1 - Add support for Oracle Linux 9.0.107-1 - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94424...

Oracle Linux 9 : .NET / 9.0 (ELSA-2025-8817)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8817 advisory. 9.0.107-1.0.1 - Add support for Oracle Linux 9.0.107-1 - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94424 Tenable has extracted the preceding...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

Security Bulletin: Go net/http package is vulnerable to a denial of service,a remote attacker could exploit this vulnerability to cause a denial of service, affects watsonx.data

Summary Go net/http package is vulnerable to a denial of service, caused by improper 100-continue header handling. By sending "Expect: 100-continue" requests, a remote attacker could exploit this vulnerability to cause a denial of service and this could affect watsonx.data. Vulnerability Details...

Security update for systemd

This update for systemd fixes the following issues: coredump: use %d in kernel core pattern CVE-2025-4598 Revert "macro: terminate the temporary VAARGSFOREACH array with a sentinel" SUSE specific umount: do not move busy network mounts bsc1236177 man/pstore.conf: pstore.conf template is not alway...

SUSE-SU-2025:20416-1 Security update for systemd

This update for systemd fixes the following issues: - coredump: use %d in kernel core pattern CVE-2025-4598 - Revert "macro: terminate the temporary VAARGSFOREACH array with a sentinel" SUSE specific - umount: do not move busy network mounts bsc1236177 - man/pstore.conf: pstore.conf template is n...

Remote Code Execution (RCE)

.NET is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure file handling due to the ability of an attacker to place files in specific locations that can trigger execution of unintended code...

SUSE-SU-2025:20405-1 Security update for systemd

This update for systemd fixes the following issues: - coredump: use %d in kernel core pattern CVE-2025-4598 - Revert "macro: terminate the temporary VAARGSFOREACH array with a sentinel" SUSE specific - umount: do not move busy network mounts bsc1236177 - man/pstore.conf: pstore.conf template is n...

Security update for systemd

This update for systemd fixes the following issues: coredump: use %d in kernel core pattern CVE-2025-4598 Revert "macro: terminate the temporary VAARGSFOREACH array with a sentinel" SUSE specific umount: do not move busy network mounts bsc1236177 man/pstore.conf: pstore.conf template is not alway...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

AlmaLinux 8 : .NET 8.0 (ALSA-2025:8812)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8812 advisory. dotnet: .NET Remote Code Vulnerability CVE-2025-30399 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note tha...

Oracle Linux 8 : .NET / 9.0 (ELSA-2025-8815)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8815 advisory. 9.0.107-1.0.1 - Add support for Oracle Linux 9.0.107-1 - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94422 Tenable has extracted the preceding...