Resource Injection

Overview NuGet.Packaging is a NuGet's implementation for reading nupkg package and nuspec package specification files. Affected versions of this package are vulnerable to Resource Injection in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can bypass...

Cross-site Scripting (XSS)

Overview NuGetGallery is a Core support library for NuGet Gallery Frontend and Backend. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the handling of HTML element attributes. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...

The vulnerability of the package manager for the .net platform, NuGetGallery, arises from the lack of protective measures for the website structure. This allows attackers to execute cross-site scripting attacks.

The vulnerability of the package manager for the .net NuGetGallery relates to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...