CVE-2020-1147

CVE-2020-1147 affects the .NET Framework, SharePoint Server, and Visual Studio. The root cause is improper handling of XML input, specifically a failure to validate the source markup during deserialization, which can lead to remote code execution. The vulnerability is characterized by the ability...

CVE-2024-43590

CVE-2024-43590 is a local elevation-of-privilege vulnerability in the Visual C++ Redistributable Installer. A local attacker with Low privileges could exploit this (UI: none) to gain High confidentiality, integrity, and availability impact, with the attack vector being local and requiring Low pri...

CVE-2023-36796

CVE-2023-36796 is a .NET Framework RCE vulnerability in DiaSymReader.dll triggered when reading a corrupted PDB file. It affects .NET Framework 3.5 and 4.8.1 on Windows Server/Windows OS configurations described in KB5029918. Mitigation: apply the corresponding cumulative update (KB5029918) or th...

CVE-2023-36792

CVE-2023-36792 is a Windows-only Visual Studio/.NET remote code execution vulnerability. Root cause: Microsoft.DiaSymReader.Native.amd64.dll mishandles corrupted PDB files, enabling RCE. Affected: .NET 6.0 and .NET 7.0 runtimes (applications) prior to patched versions. Patched versions: .NET 6.0....

CVE-2023-36793

CVE-2023-36793 is a Microsoft .NET/Visual Studio remote code execution vulnerability. It stems from Microsoft.DiaSymReader.Native.amd64.dll reading a corrupted PDB file, affecting Windows systems. Affected: .NET 7.0 up to 7.0.10 and .NET 6.0 up to 6.0.21. Patched versions: .NET 7.0.11 and .NET 6....

CVE-2023-36794

CVE-2023-36794 is a Visual Studio/.NET remote code execution vulnerability. Affects Windows applications using Microsoft.DiaSymReader.Native.amd64.dll when reading corrupted PDB files, potentially enabling code execution. Affected: .NET 6.0 and .NET 7.0 runtimes and Visual Studio environments; pa...

CVE-2025-21172

CVE-2025-21172 is a Microsoft .NET/Visual Studio remote code execution vulnerability. The linked CVE record notes the root cause as an integer overflow and a heap-based overflow in msdia140.dll, yielding a high-impact remote code execution scenario over network; exploitation status is not detaile...

CVE-2022-23267

CVE-2022-23267 is a .NET Denial of Service vulnerability. The connected sources describe a DoS arising from a crafted HttpClient request that can exhaust memory and impact .NET/ASP.NET/Visual Studio environments. The IBM RPA bulletin lists CVE-2022-23267 as part of multiple vulnerabilities with r...

CVE-2022-29117

CVE-2022-29117 is described as a denial-of-service vulnerability in Microsoft ASP.NET and Visual Studio. The entry notes a network-exploit path with no authentication required, leading to an availability impact (CVE-2022-29117) with CVSS v3.1 base score 7.5 (HIGH) and CVSS v2.0 base score 5.0 (PA...

CVE-2023-21808

CVE-2023-21808 is a remote code execution vulnerability in .NET and Visual Studio related to how debugging symbols are read. Connected sources confirm affected products include .NET 6.0/7.0 runtimes and SDKs and Visual Studio components, with the root cause in the handling of symbol files (debug ...

CVE-2022-24464

CVE-2022-24464 is a denial-of-service vulnerability affecting Microsoft ASP.NET Core and Visual Studio components. Multiple connected sources describe a DoS condition triggered by certain inputs, with public scoring indicating a high impact (CVSSv3.1: 7.5, network attack, no authentication, avail...

CVE-2023-24897

CVE-2023-24897 covers a .NET/.NET Framework/Visual Studio Remote Code Execution vulnerability. Public advisories attribute the flaw to the MSDIA SDK (causing heap overflow due to corrupted PDBs) and enable RCE under certain conditions. Affected products include .NET 6/7 runtimes and corresponding...

CVE-2022-29145

CVE-2022-29145 is a .NET denial-of-service vulnerability. The GitHub advisory (GHSA-fcg8-mg9g-6hc4) states exploitation via parsing HTML forms can cause DoS in .NET 6.0, .NET 5.0, and .NET Core 3.1. Affected versions include .NET Core 3.1 (3.1.24 and earlier), .NET 5.0 (5.0.16 and earlier), and ....

CVE-2024-20656

CVE-2024-20656 is a Microsoft Visual Studio elevation-of-privilege vulnerability. Public sources indicate it stems from how Diagnostics Hub Standard Collector handles data operations, enabling a local attacker to gain SYSTEM privileges when exploiting Visual Studio components. The vulnerability i...

CVE-2020-1108

CVE-2020-1108 affects Microsoft .NET Core and .NET Framework; a denial-of-service can be caused by improper handling of incoming web requests. The IBM security bulletin (referencing IBM X-Force) lists a base score of 7.5 (HIGH) and notes the vulnerability affects IBM Robotic Process Automation pr...

CVE-2022-24513

CVE-2022-24513 is a Visual Studio elevation-of-privilege vulnerability with a LOCAL attack vector, exploitation requiring LOW privileges, and HIGH impact on confidentiality, integrity, and availability per CVSSv3. Connected sources confirm this CVE is discussed in Microsoft advisories and securit...

CVE-2021-26423

CVE-2021-26423 is a .NET Core/ASP.NET DoS vulnerability described as a denial of service in WebSocket frame processing. The primary documentation identifies affected software as .NET Core and Visual Studio (Denial of Service Vulnerability) with network-based exposure and low attack complexity. Co...

CVE-2022-38013

CVE-2022-38013 is a .NET Denial of Service vulnerability affecting .NET Core and related components across multiple Linux distributions. The connected documents reference updates and security fixes for various package families (e.g., ALT Linux packages dotnet-bootstrap, dotnet-aspnetcore, dotnet-...

CVE-2022-41032

IBM Robotic Process Automation for Cloud Pak is affected by CVE-2022-41032 (Microsoft NuGet Client elevation of privilege). The advisory links this vulnerability to the base container images and recommends updating IBM RPA for Cloud Pak to 21.0.6 or higher to remediate. The bulletin lists CVE-202...

CVE-2021-31204

CVE-2021-31204 affects .NET Core/.NET 5.x components. Multiple connected advisories describe an elevation-of-privilege vulnerability in .NET 5.0 and .NET Core 3.1 when a user runs a single-file application on Linux/macOS, allowing privilege escalation. Upstream fixes exist: Runtime/SDK updates to...

CVE-2021-31957

The CVE-2021-31957 issue is an ASP.NET Core Denial of Service vulnerability. It affects ASP.NET Core apps when handling client disconnects, allowing remote attackers to trigger a DoS without authentication. Affected platforms include .NET 5.0 and .NET Core 3.1 runtimes. The advisory states that e...

CVE-2022-21986

CVE-2022-21986 is a .NET Denial of Service vulnerability in the Kestrel web server. The issue arises when processing certain HTTP/2 and HTTP/3 requests, enabling remote network-based DoS with low attack complexity. Affected products include .NET 6.0 up to 6.0.1 and .NET 5.0 up to 5.0.13. Remediat...

CVE-2022-24767

CVE-2022-24767 affects Git for Windows prior to 2.35.2, where the uninstaller is vulnerable to DLL hijacking when executed under the SYSTEM account. Root cause: uninstaller loads a malicious DLL from a user-writable path, enabling potential arbitrary code execution or compromise of the host as de...

CVE-2021-42277

Technical details about CVE-2021-42277 are not provided in the connected documents; only generic vulnerability labels and references are available. Monitor for official advisories or CVE records for affected products, fixes, and mitigations.

CVE-2019-1351

CVE-2019-1351 refers to a tampering vulnerability in Git for Visual Studio, caused by improper handling of virtual drive paths. The available documents explicitly identify the issue as a tampering vulnerability and name the affected component, but they do not provide exploit details, affected ver...

CVE-2021-1723

CVE-2021-1723 is an ASP.NET Core/dotnet-denial-of-service issue related to the HTTP/2 path. Connected advisories cite that running callbacks outside of locks can cause a Krestel deadlock, leading to a DoS condition. Affected products include dotnet-runtime and related packages (Azure/Visual Studi...

CVE-2022-21871

Technical details about CVE-2022-21871 are not publicly provided in the supplied documents; no affected product/version, root cause, or remediation are described here. Monitor for official disclosures and updates.

CVE-2023-21815

CVE-2023-21815 is a Visual Studio remote code execution vulnerability. The connected Microsoft KB entries state it exists in Visual Studio 2013 Update 5 and is caused by improper handling of debug information, enabling remote code execution. The updated security fixes (KB5026610 for VS2013 Update...

CVE-2021-1651

Technical details about CVE-2021-1651 are not provided in the supplied documents; only the vulnerability is named. Monitor for updates from official advisories.

CVE-2019-0727

CVE-2019-0727 describes an elevation-of-privilege flaw in the Diagnostics Hub Standard Collector and the Visual Studio Standard Collector, allowing an attacker who can log on to delete files in arbitrary locations. The vulnerability is rooted in the collectors’ handling of file deletion permissio...

CVE-2021-1639

CVE-2021-1639 appears as a Visual Studio Code remote code execution vulnerability. Connected sources confirm Visual Studio Code is affected and note public exploits exist (Kaspersky). The documents provide high-severity impact for this CVE but do not consistently expose concrete root-cause detail...

CVE-2023-28296

CVE-2023-28296 is a Microsoft Visual Studio remote code execution vulnerability with multiple affected products (Visual Studio 2022/2019, .NET components, and Visual Studio Code). The root cause is not explicitly detailed here, but the CVSSv3.1 scores it as a high-severity, locally exploitable is...

CVE-2020-1597

CVE-2020-1597 is a denial-of-service vulnerability in ASP.NET Core where remote, unauthenticated attackers can cause resource exhaustion by sending specially crafted web requests. The flaw stems from how ASP.NET Core handles incoming requests and is fixed by an update that corrects request handli...

CVE-2020-1161

CVE-2020-1161 is a denial-of-service vulnerability in ASP.NET Core where improper handling of web requests can trigger a DoS. It is referenced in multiple advisories (e.g., RHSA-2020:2250 and ELSA-2020-2250) as part of the .NET Core DoS fixes. The connected Red Hat advisories indicate the remedia...

CVE-2023-23381

CVE-2023-23381 is a Visual Studio remote code execution vulnerability. Connected documents confirm this CVE is referenced in Microsoft security updates for multiple Visual Studio versions (e.g., VS2013 Update 5 and VS2015 Update 3) with patches/KB articles available (KB5026610, KB5025792). The KB...

CVE-2019-1232

CVE-2019-1232 is a local elevation-of-privilege flaw in the Diagnostics Hub Standard Collector Service. Affected: Diagnostics Hub Standard Collector Service; root cause: improper impersonation of certain file operations. Impact per sources: confidentiality, integrity, and availability are rated p...

CVE-2023-28262

CVE-2023-28262 is a Microsoft Visual Studio elevation of privilege vulnerability. Several connected sources (e.g., NCSC advisories) confirm a privilege-escalation flaw affecting multiple Visual Studio products, including various Visual Studio versions (e.g., 2017/2019/2022 lines) and Visual Studi...

CVE-2020-17156

CVE-2020-17156 is a Microsoft Visual Studio remote code execution vulnerability. Connected sources corroborate a Visual Studio/Developer Tools exposure with high-severity impact (CVSS v3.1 base 7.8) and note that an update is available from Microsoft/MSRC to fix it. Affected products include vari...

CVE-2020-1133

Technical details about CVE-2020-1133 are not publicly provided in the connected documents. Available sources mention Diagnostics Hub Standard Collector and the fix, but no affected versions, exploit specifics, or mitigation steps are given. Monitor for updates.

CVE-2020-1130

CVE-2020-1130 affects the Diagnostics Hub Standard Collector. The issue is an elevation of privilege in the collector’s data handling, enabling a crafted local application to run processes in an elevated context. The vulnerability is addressed by updating how the Diagnostics Hub Standard Collecto...

CVE-2023-21566

CVE-2023-21566 is a Visual Studio elevation-of-privilege vulnerability. The linked documents describe insufficient access restrictions in Visual Studio that can allow a local attacker with low privileges to escalate to higher privileges (obtaining increased entitlements). Exploitation is local an...

CVE-2020-1202

CVE-2020-1202 affects Diagnostics Hub Standard Collector or Visual Studio Standard Collector. Root cause: improper handling of memory objects leading to elevation of privilege. Impact: local elevation of privileges if exploited; CVSS data in the Initial document indicates HIGH severity. Exploitat...

CVE-2021-28321

CVE-2021-28321 is a elevation-of-privilege issue in the Diagnostics Hub Standard Collector Service. The NVD entry lists a local, low-attack‑complexity vector with no authentication, achieving high impact on confidentiality, integrity, and availability (CVSS‑3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:...

CVE-2021-26434

CVE-2021-26434 is a Visual Studio local privilege escalation. The issue arises during installation of Game development with C++/Unreal Engine workload, where the installer creates a directory with write permissions for all users, enabling LPE. Affected products include various Visual Studio versi...

CVE-2020-0810

CVE-2020-0810 affects the Diagnostics Hub Standard Collector and the Visual Studio Standard Collector on Windows. The root cause is an elevation of privilege vulnerability allowing file creation in arbitrary locations, exploitable by a logged-on attacker who runs a crafted application; this could...

CVE-2020-1393

Summary: CVE-2020-1393 is an elevation of privilege in Windows Diagnostics Hub related to the Standard Collector Service failing to sanitize input, causing insecure library loading. The root cause is input validation/sanitization weaknesses leading to loading of untrusted libraries. This CVE is r...

CVE-2021-28313

Technical details about CVE-2021-28313 are not publicly provided in the supplied documents. Monitor for updates from NVD, MSRC, and vendor advisories for affected components and fixes.

CVE-2021-36952

The linked Nessus entry for CVE-2021-36952 identifies Visual Studio as affected, describing a local, memory-handling vulnerability that an unauthenticated attacker can exploit to bypass authentication and execute arbitrary commands. This is stated as a Visual Studio code-execution issue caused by...

CVE-2022-41119

CVE-2022-41119 concerns Microsoft Visual Studio Remote Code Execution. Connected sources describe it as a Visual Studio vulnerability leading to arbitrary code execution, attributed to insufficient input validation in Visual Studio and affecting multiple VS versions (including 2017/2019 and 2022 ...

CVE-2021-28322

Technical details about CVE-2021-28322 are not publicly provided in the supplied documents. No affected products, exploit information, or fixes are described here. Monitor for updates from the referenced advisories and vulnerability feeds.