1976 matches found
dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
.NET and Visual Studio Information Disclosure Vulnerability...
Potential leak of NuGet.org API key
Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET Core 3.1, NuGet NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0. This advisory also provides guidance on what...
GHSA-3885-8GQC-3WPF Potential leak of NuGet.org API key
Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET Core 3.1, NuGet NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0. This advisory also provides guidance on what...
Microsoft .NET Core和Microsoft Visual Studio 安全漏洞
Microsoft Visual Studio and Microsoft .NET Core are both products of Microsoft Corporation. Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle. Microsoft .NET...
PT-2022-7020
Name of the Vulnerable Software and Affected Versions .NET versions prior to 6.0.6 .NET Core versions prior to 3.1.26 NuGet versions prior to 6.2.1 NuGet.exe versions prior to 6.2.1 NuGet.Commands versions prior to 6.2.1 NuGet.CommandLine versions prior to 6.2.1 NuGet.CommandLine.XPlat versions...
Incorrect Permission Assignment for Critical Resource
Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the modification of contents in the intermediate build folder by default obj. An attacker can alter the contents of this folder by authenticating and exploiting the...
NuGet Package Manager Tampering Vulnerability
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder by default obj, aka 'NuGet Package Manager Tampering Vulnerability'...
GHSA-3HCM-6FJC-47QQ NuGet Package Manager Tampering Vulnerability
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder by default obj, aka 'NuGet Package Manager Tampering Vulnerability'...
XML external entity vulnerability in Jenkins Nuget Plugin
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This XML parser is used for the "Build on NuGet updates" feature. This allows attackers with the ability to control the contents of the packages.config file in a workspace to have...
GHSA-P674-HH8X-RV5H XML external entity vulnerability in Jenkins Nuget Plugin
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This XML parser is used for the "Build on NuGet updates" feature. This allows attackers with the ability to control the contents of the packages.config file in a workspace to have...
IpMatcher 1.0.4.1 Server-Side Request Forgery Vulnerability
IpMatcher versions 1.0.4.1 and below for .NET Core 2.0 and .NET Framework 4.5.2 incorrectly validates octal and hexadecimal input data which can lead to indeterminate server-side request forgery, local file inclusion, remote file inclusion, and denial of service vectors. Exploit Title: SSRF in .N...
YARP Denial of Service Vulnerability
Impact A denial of service vulnerability exists in how YARP processes input. Patches If you're using YARP 1.0.0, you should update to NuGet package version 1.0.1. If you're using YARP 1.1.0-RC.1, you should update to NuGet package version 1.1.0-rc.1.22211.2. You can do so by updating the...
GHSA-8XC6-G8XW-H2C4 YARP Denial of Service Vulnerability
Impact A denial of service vulnerability exists in how YARP processes input. Patches If you're using YARP 1.0.0, you should update to NuGet package version 1.0.1. If you're using YARP 1.1.0-RC.1, you should update to NuGet package version 1.1.0-rc.1.22211.2. You can do so by updating the...
Cross-site Scripting OrchardCore.Application.Cms.Targets
Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...
CVE-2022-0243
Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...
Cross site scripting
Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...
CVE-2022-0243 Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...
CVE-2022-0243
Summary (CVE-2022-0243): Stored Cross-site Scripting (XSS) vulnerability in Orchard Core prior to 1.2.2, affecting the NuGet package OrchardCore.Application.Cms.Targets. The root cause, as stated in sources, is inadequate escaping/validation of user-submitted data, leading to malicious JavaScript...