BIT-GITLAB-2020-12448

GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet...

BIT-GITLAB-2021-22168

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8...

BIT-GITLAB-2022-3478

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package...

BIT-DOTNET-SDK-2022-41032 NuGet Client Elevation of Privilege Vulnerability

NuGet Client Elevation of Privilege Vulnerability...

BIT-DOTNET-2022-41032 NuGet Client Elevation of Privilege Vulnerability

NuGet Client Elevation of Privilege Vulnerability...

NuGet Installed Packages (Linux / Unix)

Binary data nugetpackageenumerationnixinstalled.nbin...

NuGet Installed Packages (Windows)

Binary data nugetpackageenumerationwininstalled.nbin...

GHSA-68W7-72JG-6QPP NuGet Client Security Feature Bypass Vulnerability

Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. A security feature bypass...

NuGet Client Security Feature Bypass Vulnerability

Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. A security feature bypass...

Improper Access Control

Overview NuGet.Packaging is a NuGet's implementation for reading nupkg package and nuspec package specification files. Affected versions of this package are vulnerable to Improper Access Control when using X.509 chain building APIs but do not completely validate the X.509 certificate due to a log...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control when using X.509 chain building APIs but do not completely validate the X.509 certificate due to a logic flaw. An attacker could present an arbitrary untrusted certificate with malformed signatures, triggering a...

Duplicate Advisory: NuGet Client Security Feature Bypass Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-68w7-72jg-6qpp. This link is maintained to preserve external references. Original Description NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability...

GHSA-JW42-5M4V-9C8G Duplicate Advisory: NuGet Client Security Feature Bypass Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-68w7-72jg-6qpp. This link is maintained to preserve external references. Original Description NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability...

CVE-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability...

Microsoft Identity Services Security Vulnerability

Microsoft Identity Linux Broker is a Linux identity broker from Microsoft Corporation USA. A security vulnerability exists in Microsoft Identity Services. An attacker could exploit this vulnerability to cause a denial of service. The following products and versions are affected: .NET 7.0, .NET...

GHSA-8V6J-GC74-FMPP Ajax Pro Cross-site Scripting

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects. Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise...

Ajax Pro Cross-site Scripting

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects. Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise...

Malicious NuGet Packages Caught Distributing SeroXen RAT Malware

Cybersecurity researchers have uncovered a new set of malicious packages published to the NuGet package manager using a lesser-known method for malware deployment. Software supply chain security firm ReversingLabs described the campaign as coordinated and ongoing since August 1, 2023, while linki...

SUSE CVE-2019-0757

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'...

SeroXen RAT Leverages NuGet Packages

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Several malicious packages have been detected in NuGet, a widely used package manager for the .NET Framework. These packages utilized typosquatting methods to masquerade as legitimate ones and were...