dotnet: Denial of Service in SignalR server

A denial of service vulnerability is present in the .NET applications utilizing SignalR, which a malicious client can exploit. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service DoS attack by providing...

PT-2024-4727 · Microsoft · Net Core

Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names in the .NET Core component of the "Сервис оправдательных документов" software. Exploitation of...

Race Condition

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Race Condition through the...

.NET and Visual Studio 安全漏洞

Microsoft .NET Core and Microsoft Visual Studio are both products of Microsoft Corporation USA. NET Core is a free and open source development platform. The platform features multi-language support and cross-platform.Microsoft Visual Studio is a family of development tool suites and a fundamental...

May 14, 2024-KB5038283 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 2019

None None...

May 14, 2024-KB5038282 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows Server 2022

None None...

May 14, 2024-KB5037926 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server 2016

None None...

May 14, 2024-KB5038285 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2

None None...

Important: dotnet6.0

Issue Overview: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2024-21409 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.4.20240429 or dnf update --advisory ALAS2023-2024-597 --releasever 2023.4.20240429 to update your...

VulnCheck KEV: CVE-2024-29059

Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution...

Vulnerability of Microsoft .NET Framework, .NET software platforms, and Microsoft Visual Studio development tools, related to memory usage after memory is released, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft’s software platforms, such as the .NET Framework, .NET, and Microsoft Visual Studio, relates to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

U.S. Dept Of Defense: [███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)

A vulnerability was discovered in Microsoft .NET Framework that could allow a remote attacker to obtain sensitive information. The vulnerability was caused by the potential disclosure of ObjRef URIs, which could be used to perform .NET Remoting attacks via HTTP. The vulnerability was assigned the...

CVE-2024-32028

OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore the url.full writes attribute/tag on spans Activity when tracing is enabled for outgoing http requests and...

CVE-2024-32028 Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore the url.full writes attribute/tag on spans Activity when tracing is enabled for outgoing http requests and...

CVE-2024-32028

OpenTelemetry dotnet has a vulnerability in OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore where url.full and url.query values were written to spans, potentially exposing sensitive data. Affected versions prior to 1.8.1 pass the raw query string; 1.8.1 and later r...

[SECURITY] Fedora 39 Update: dotnet8.0-8.0.103-1.fc39

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

CVE-2024-21409

A use-after-free flaw was found in dotnet. This issue can result in code execution when viewing untrusted documents...

CVE-2024-29992

Azure Identity Library for .NET Information Disclosure Vulnerability...

PT-2024-3008 · Microsoft +1 · Visual Studio +3

Name of the Vulnerable Software and Affected Versions: .NET Framework versions affected versions not specified .NET versions affected versions not specified Visual Studio versions affected versions not specified Description: The issue is related to the use of memory after it has been freed, which...

dotnet: Denial of Service in X509Certificate2

A denial of service vulnerability exists in .NET applications with OpenSSL support when parsing X509 certificates. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service DoS attack by providing specially crafte...