CVE-2019-0757

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'...

CVE-2019-0757: Undefined Security Weakness

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'...

The vulnerability of the NuGet package management system allows a hacker to alter the folder structure of a package.

The vulnerability of the NuGet package management system is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to alter the package’s folder structure...

Microsoft Visual Studio NuGet Package Manager Tampering Vulnerability - Mac OS X

Visual Studio is prone to tampering vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:visualstudio";...

dotnet: NuGet Tampering Vulnerability

A flaw was found in dotnet. A tampering vulnerability exists in NuGet software when executed in a Linux or Mac environment. An attacker who successfully exploits the vulnerability could run arbitrary code in the context of the current user. The highest threat from this vulnerability is to data...

Important: Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update for March 2019

Updates for rh-dotnetcore10-dotnetcore, rh-dotnetcore11-dotnetcore, rh-dotnet21-dotnet, and rh-dotnet22-dotnet are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syste...

Security fix for the ALT Linux 9 package dotnet-bootstrap-5.0 version 2.1.9-alt1

March 13, 2019 Vitaly Lipatov 2.1.9-alt1 - new version 2.1.9 with rpmrb script - includes .NET Core 2.1.9, ASP.NET Core 2.1.9 and .NET Core SDK 2.1.505 - CVE-2019-0657: .NET Core NuGet Tampering Vulnerability...

Security fix for the ALT Linux 10 package dotnet-bootstrap-5.0 version 2.1.9-alt1

March 13, 2019 Vitaly Lipatov 2.1.9-alt1 - new version 2.1.9 with rpmrb script - includes .NET Core 2.1.9, ASP.NET Core 2.1.9 and .NET Core SDK 2.1.505 - CVE-2019-0657: .NET Core NuGet Tampering Vulnerability...

Security fix for the ALT Linux 10 package dotnet-bootstrap-6.0 version 2.1.9-alt1

March 13, 2019 Vitaly Lipatov 2.1.9-alt1 - new version 2.1.9 with rpmrb script - includes .NET Core 2.1.9, ASP.NET Core 2.1.9 and .NET Core SDK 2.1.505 - CVE-2019-0657: .NET Core NuGet Tampering Vulnerability...

Microsoft .NET Core NuGet Package Manager Tampering Vulnerability - Linux

.NET Core is prone to tampering vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:.netcore"; ifdescription...

Microsoft Patches Two Win32k Bugs Under Active Attack

Microsoft released patches for two Win32k bugs actively under attack, along with fixes for four additional bugs that are publicly known, as part of its March Patch Tuesday security bulletin. The Win32k bugs are both elevation of privilege vulnerabilities, rated important, and tied to the way...

NuGet Package Manager Tampering Vulnerability

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure. An attacker who successfully exploited this vulnerability could potentially modify files and folders that are unpackaged on a...

Security Update for .NET Core SDK (March 2019)

The remote Windows host has an installation of .NET Core SDK with a version of 1.x 1.1.13 or 2.1.x 2.1.505. Therefore, the host is affected by a tampering vulnerability with in the NuGet Package Manager. An authenticated, attacker can exploit this, via manipulating the folder contents prior to...

Microsoft NuGet Package Manager CVE-2019-0757 Tampering Security Bypass Vulnerability

Description Microsoft NuGet is prone to a security bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Technologies Affected Microsoft .NET Core 1.0 Microsoft .NET Core 1.1 Microsoft .NET Core 2.1 Microsoft .NET Core S...

KLA11433 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A tampering vulnerability in NuGet Package Manager can be exploited remotely to spoo...

PT-2019-1638

Name of the Vulnerable Software and Affected Versions NuGet Package Manager for Linux and Mac affected versions not specified Description A tampering issue exists in the NuGet Package Manager that could allow an authenticated attacker to modify a NuGet package's folder structure. The vulnerabilit...

Debian DLA-1564-1 : mono security update

It was found that Monos string-to-double parser may crash, on specially crafted input. This could lead to arbitrary code execution. CVE-2018-1002208: Mono embeds the sharplibzip library which is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot...

UPDATE: OWASP Dependency-Check 3.3.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 3.3.0, which includes a lot of bug...

Microsoft Windows SMB Server (v1v2) - Mount Point Arbitrary Device Open Privilege Escalation

Microsoft Windows SMB Server v1v2 - Mount Point Arbitrary Device Open Privilege Escalation Windows: SMB Server v1 and v2 Mount Point Arbitrary Device Open EoP Platform: Windows 10 1703 and 1709 seems the same on 7 and 8.1 but not extensively tested Class: Elevation of Privilege Summary: The SMB...

Octopus Deploy Directory Traversal Vulnerability

In Octopus Deploy, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value. SPDX-FileCopyrightText: 2017 Greenbone ...