PT-2023-5001 · Microsoft · Visual Studio

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio affected versions not specified Description: The issue is related to insufficient access control in Microsoft Visual Studio, which can be exploited to elevate privileges. Recommendations: At the moment, there is no...

Important: dotnet6.0

Issue Overview: .NET and Visual Studio Remote Code Execution Vulnerability CVE-2023-35390 .NET Core and Visual Studio Denial of Service Vulnerability CVE-2023-38178 .NET and Visual Studio Denial of Service Vulnerability CVE-2023-38180 Affected Packages: dotnet6.0 Issue Correction: Run dnf update...

Rocky Linux 8 : .NET 6.0 (RLSA-2023:4059)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:4059 advisory. - ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Note that Nessus has not tested for this issue but has instead relied only on th...

Rocky Linux 8 : .NET 7.0 (RLSA-2023:3593)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3593 advisory. - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2023-24936 - .NET, .NET Framework, and Visual Studio Denial of Servic...

Security Update for Microsoft Visual Studio Code Concourse CI Pipeline Editor Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Concourse CI Pipeline Editor Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that...

Security Update for Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML...

Security Update for Microsoft Visual Studio Code Bosh Editor Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Bosh Editor Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain...

Security Update for Microsoft Visual Studio Code Spring Boot Tools Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Spring Boot Tools Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certa...

Important: dotnet6.0

Issue Overview: ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.1.20230825 or dnf update --advisory ALAS2023-2023-302 --releasever 2023.1.20230825 to update your system. More...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-302)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-302 advisory. ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...

Oracle Linux 9 : .NET / 7.0 (ELSA-2023-4642)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4642 advisory. 7.0.110-1.0.1 - Update to .NET SDK 7.0.110 and Runtime 7.0.10 - Resolves: RHBZ2228571 Tenable has extracted the preceding description block directly fr...

Oracle Linux 8 : .NET / 7.0 (ELSA-2023-4643)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4643 advisory. 7.0.110-1.0.1 - Update to .NET SDK 7.0.110 and Runtime 7.0.10 - Resolves: RHBZ2228571 Tenable has extracted the preceding description block directly fr...

Information Disclosure

ASP.NET Core SignalR and Visual Studio is vulnerable to Information Disclosure. This vulnerability occurs when a user sends a specially crafted message to a SignalR hub. If the message is valid, the user can obtain sensitive information, such as the names of other users in the hub...

CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a recently patched security flaw in Microsoft's .NET and Visual Studio products to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Tracked as CVE-2023-38180 CVSS score: 7.5, the...

Microsoft Visual Studio .NET Information Disclosure

The vulnerability of the Microsoft Visual Studio software and the Microsoft.NET platform is related to insufficient testing of input data. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...

Ubuntu 22.04 LTS : .NET vulnerabilities (USN-6278-2)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6278-2 advisory. USN-6278-1 fixed several vulnerabilities in .NET. This update provides the corresponding updates for Ubuntu 22.04 LTS. Tenable has extracted the precedin...

Microsoft Visual Studio Information Disclosure

The vulnerability of Microsoft Visual Studio, a software development tool, and the Microsoft.NET platform is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

August Patch Tuesday stops actively exploited attack chain and more

Augusts Patch Tuesday is a lot quieter than it was last month, when Microsoft patched a whopping 130 vulnerabilities. That number went down to 87 this month but it does include two actively exploited vulnerabilities. Lets start by looking at those two: CVE-2023-38180 CVSS score 7.5 out of 10: a...

Security Updates for Microsoft Visual Studio Products (August 2023)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - .NET Core and Visual Studio Denial of Service Vulnerability. CVE-2023-38178 - .NET and Visual Studio Remote Code Execution Vulnerability. CVE-2023-35390 - .NET and Visual...

Security Updates for Microsoft Visual Studio Office Tools (August 2023)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by - Visual Studio Tools for Office Runtime Spoofing Vulnerability. CVE-2023-36897 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...