CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2023-38180

CVE-2023-38180 is a .NET/Visual Studio denial-of-service vulnerability (DoS) affecting .NET Core and related components. The CVSSv3.1 vector indicates Network attack, low attack complexity, no privileges required, with no confidentiality/integirty impact but a High availability impact. Moderate-t...

CVE-2024-43590

CVE-2024-43590 is a local elevation-of-privilege vulnerability in the Visual C++ Redistributable Installer. A local attacker with Low privileges could exploit this (UI: none) to gain High confidentiality, integrity, and availability impact, with the attack vector being local and requiring Low pri...

CVE-2023-28260

CVE-2023-28260 is a .NET DLL Hijacking remote code execution vulnerability. The connected sources identify affected software as .NET 6.0 and .NET 7.0 runtimes/applications, with exploitation arising when a runtime DLL is loaded from an unexpected location. Affected versions include .NET 7.0 up to...

CVE-2023-36796

CVE-2023-36796 is a .NET Framework RCE vulnerability in DiaSymReader.dll triggered when reading a corrupted PDB file. It affects .NET Framework 3.5 and 4.8.1 on Windows Server/Windows OS configurations described in KB5029918. Mitigation: apply the corresponding cumulative update (KB5029918) or th...

CVE-2023-36792

CVE-2023-36792 is a Windows-only Visual Studio/.NET remote code execution vulnerability. Root cause: Microsoft.DiaSymReader.Native.amd64.dll mishandles corrupted PDB files, enabling RCE. Affected: .NET 6.0 and .NET 7.0 runtimes (applications) prior to patched versions. Patched versions: .NET 6.0....

CVE-2023-36793

CVE-2023-36793 is a Microsoft .NET/Visual Studio remote code execution vulnerability. It stems from Microsoft.DiaSymReader.Native.amd64.dll reading a corrupted PDB file, affecting Windows systems. Affected: .NET 7.0 up to 7.0.10 and .NET 6.0 up to 6.0.21. Patched versions: .NET 7.0.11 and .NET 6....

CVE-2023-36794

CVE-2023-36794 is a Visual Studio/.NET remote code execution vulnerability. Affects Windows applications using Microsoft.DiaSymReader.Native.amd64.dll when reading corrupted PDB files, potentially enabling code execution. Affected: .NET 6.0 and .NET 7.0 runtimes and Visual Studio environments; pa...

CVE-2025-21172

CVE-2025-21172 is a Microsoft .NET/Visual Studio remote code execution vulnerability. The linked CVE record notes the root cause as an integer overflow and a heap-based overflow in msdia140.dll, yielding a high-impact remote code execution scenario over network; exploitation status is not detaile...

CVE-2024-30105

CVE-2024-30105 affects .NET 8.0 applications (notably involving System.Text.Json) and can cause a Denial of Service when deserializing untrusted input via JsonSerializer.DeserializeAsyncEnumerable. Connected advisories confirm the vulnerability in .NET Core/Visual Studio with DoS conditions and i...

CVE-2023-38171

CVE-2023-38171 — Microsoft QUIC Denial of Service vulnerability is documented in connected advisories (MSRC/GHSA). The issue affects QUIC implementations in Windows environments and can enable a remote attacker to cause a denial-of-service by crafting specific requests to the QUIC component. The ...

CVE-2024-21386

CVE-2024-21386 is a Denial of Service vulnerability in ASP.NET SignalR affecting .NET runtimes across 6.0/7.0/8.0. The issue affects ASP.NET Core implementations using SignalR and is mitigated by updating to patched runtimes: .NET 6.0.27, 7.0.16, and 8.0.2 (with affected package entries listed in...

CVE-2024-21409

CVE-2024-21409 is described in the provided documents as a .NET family remote code execution vulnerability affecting .NET/.NET Framework and related SDKs. Concrete details in connected sources indicate affected products/versions include .NET Core/.NET SDKs prior to 6.0.29, 7.0.18, or 8.0.4, with ...

CVE-2022-23267

CVE-2022-23267 is a .NET Denial of Service vulnerability. The connected sources describe a DoS arising from a crafted HttpClient request that can exhaust memory and impact .NET/ASP.NET/Visual Studio environments. The IBM RPA bulletin lists CVE-2022-23267 as part of multiple vulnerabilities with r...

CVE-2024-21404

CVE-2024-21404 is a .NET Denial of Service vulnerability (CVSS 3.1: 7.5) with network-based vector and high availability impact. Connected advisories attribute the DoS to components in .NET such as SignalR server and X509Certificate2, and indicate exploitation is possible in affected .NET runtime...

CVE-2025-21171

CVE-2025-21171 is a remote code execution vulnerability in .NET 9.0 affecting multiple runtime packages (e.g., Microsoft.NetCore.App.Runtime.*) prior to 9.0.1. The issue allows an attacker to exploit by sending a crafted request to the vulnerable web server, potentially compromising affected host...

CVE-2024-38095

CVE-2024-38095 is a Microsoft .NET/Visual Studio DoS issue leveraged by a crafted request. IBM Robotic Process Automation (RPA) is affected on both client and server sides. Remediation in IBM advisories: upgrade IBM Robotic Process Automation to 30.0.1 or higher (client/server), and for IBM RPA f...

CVE-2025-21173

CVE-2025-21173 is a .NET Elevation of Privilege vulnerability. Confirmed remediation in connected sources: update to .NET/ASP.NET packages for dotnet8.0, specifically runtime/sdk updates (example: .NET Runtime 8.0.1.12 and related 8.0.x builds) as part of the dotnet8.0 security updates. Amazon Li...

CVE-2022-29117

CVE-2022-29117 is described as a denial-of-service vulnerability in Microsoft ASP.NET and Visual Studio. The entry notes a network-exploit path with no authentication required, leading to an availability impact (CVE-2022-29117) with CVSS v3.1 base score 7.5 (HIGH) and CVSS v2.0 base score 5.0 (PA...

CVE-2024-21392

CVE-2024-21392 affects .NET 7.0 and .NET 8.0 runtimes where specially crafted requests may trigger a resource leak, causing a Denial of Service. Affected versions include .NET 7.0 up to 7.0.16 and .NET 8.0 up to 8.0.2; patched versions are 7.0.17 and 8.0.3, respectively. The issue also impacts mu...

CVE-2024-43499

CVE-2024-43499 is a .NET 9.0 Denial of Service vulnerability impacting the NrbfDecoder component due to incorrect input validation. Affected software includes .NET 9.0 runtime/SDK prior to GA and packages such as System.Formats.Nrbf (

CVE-2023-21808

CVE-2023-21808 is a remote code execution vulnerability in .NET and Visual Studio related to how debugging symbols are read. Connected sources confirm affected products include .NET 6.0/7.0 runtimes and SDKs and Visual Studio components, with the root cause in the handling of symbol files (debug ...

CVE-2026-32177

CVE-2026-32177 is a heap-based buffer overflow in the .NET Framework that enables local privilege escalation. The issue is described across multiple sources as affecting the .NET Framework components in versions 3.5 and 4.8.1, with impact described as unauthorized elevation of privileges locally ...

CVE-2025-30399

CVE-2025-30399 is a Remote Code Execution vulnerability described as an untrusted search path in .NET and Visual Studio that allows an attacker to execute code over the network by placing files in specific locations. Connected advisories confirm affected runtimes and provide fixes: .NET 8.x runti...

CVE-2022-24464

CVE-2022-24464 is a denial-of-service vulnerability affecting Microsoft ASP.NET Core and Visual Studio components. Multiple connected sources describe a DoS condition triggered by certain inputs, with public scoring indicating a high impact (CVSSv3.1: 7.5, network attack, no authentication, avail...

CVE-2024-43483

CVE-2024-43483 is a .NET/Dotnet Framework/Visual Studio Denial of Service vulnerability. Connected advisories confirm it involves algorithmic complexity/hash flooding issues in multiple .NET components, leading to potential DoS. Affected packages span .NET 6.0 and .NET 8.0 lines across distributi...

CVE-2023-24897

CVE-2023-24897 covers a .NET/.NET Framework/Visual Studio Remote Code Execution vulnerability. Public advisories attribute the flaw to the MSDIA SDK (causing heap overflow due to corrupted PDBs) and enable RCE under certain conditions. Affected products include .NET 6/7 runtimes and corresponding...

CVE-2024-26190

CVE-2024-26190 : Microsoft QUIC (MsQuic) server component is affected by a denial-of-service vulnerability caused by a memory leak that can be triggered by multiple decodes, leading to memory exhaustion. The entry’s CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no authentication, ...

CVE-2022-29145

CVE-2022-29145 is a .NET denial-of-service vulnerability. The GitHub advisory (GHSA-fcg8-mg9g-6hc4) states exploitation via parsing HTML forms can cause DoS in .NET 6.0, .NET 5.0, and .NET Core 3.1. Affected versions include .NET Core 3.1 (3.1.24 and earlier), .NET 5.0 (5.0.16 and earlier), and ....

CVE-2024-38081

CVE-2024-38081 is a .NET/.NET Framework and Visual Studio elevation of privilege vulnerability (CVSS v3.1: 7.3, LOCAL attacker, LOW attack complexity, user interaction required,Privileges: LOW). Exploitation leads to total impact on confidentiality, integrity and availability as per the Microsoft...

CVE-2023-24895

CVE-2023-24895 is a .NET Framework/Visual Studio remote code execution vulnerability due to improper input validation. It is listed with a CVSS v3 base score of 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The connected sources identify CVE-2023-24895 as an Improper Input Vali...

CVE-2026-47302

CVE-2026-47302 describes a Denial of Service in .NET caused by allocation of resources without limits or throttling, enabling a network-based attack. Affected: .NET stack (resource allocation path) as described in the CVE entry. Impact: unauthorized denial of service over a network; CVSS 3.1 base...

CVE-2024-20656

CVE-2024-20656 is a Microsoft Visual Studio elevation-of-privilege vulnerability. Public sources indicate it stems from how Diagnostics Hub Standard Collector handles data operations, enabling a local attacker to gain SYSTEM privileges when exploiting Visual Studio components. The vulnerability i...

CVE-2022-24513

CVE-2022-24513 is a Visual Studio elevation-of-privilege vulnerability with a LOCAL attack vector, exploitation requiring LOW privileges, and HIGH impact on confidentiality, integrity, and availability per CVSSv3. Connected sources confirm this CVE is discussed in Microsoft advisories and securit...

CVE-2022-38013

CVE-2022-38013 is a .NET Denial of Service vulnerability affecting .NET Core and related components across multiple Linux distributions. The connected documents reference updates and security fixes for various package families (e.g., ALT Linux packages dotnet-bootstrap, dotnet-aspnetcore, dotnet-...

CVE-2022-41032

IBM Robotic Process Automation for Cloud Pak is affected by CVE-2022-41032 (Microsoft NuGet Client elevation of privilege). The advisory links this vulnerability to the base container images and recommends updating IBM RPA for Cloud Pak to 21.0.6 or higher to remediate. The bulletin lists CVE-202...

CVE-2026-62897

CVE-2026-62897 affects the .NET Framework due to an integer overflow/wraparound in a component, allowing a locally authenticated attacker to execute code. Root cause: integer overflow vulnerability; impact: local code execution with high confidentiality, integrity, and availability impacts per CV...

CVE-2024-43484

Summary of CVE-2024-43484 and related context : The connected documents corroborate a denial-of-service vulnerability affecting .NET/Visual Studio components, attributed to algorithmic complexity in both System.IO.Packaging (CVE-2024-43484) and related areas such as System.Text.Json (CVE-2024-434...

CVE-2023-33128

CVE-2023-33128 is a .NET/Visual Studio Remote Code Execution vulnerability. IBM’s bulletin ties it to Remote Code Execution via crafted input (Source Generators issue) and unmanaged heap corruption, requiring an authenticated user. Affected: Microsoft .NET/Visual Studio; impact: arbitrary code ex...

CVE-2023-35391

CVE-2023-35391 affects Microsoft ASP.NET Core SignalR and Visual Studio, exposing sensitive information through the ASP.NET Core SignalR backplane (e.g., Redis backplane) in affected .NET/ASP.NET Core deployments. Connected sources specify that exploitation involves information disclosure via Sig...

CVE-2024-43485

CVE-2024-43485 is a denial-of-service vulnerability in Microsoft .NET and Visual Studio. The IBM security bulletins corroborate the CVE and specify version-specific remediation: IBM Robotic Process Automation and IBM/Instana-related products are advised to upgrade to fixed releases (e.g., IBM Rob...

CVE-2026-70354

CVE-2026-70354 is an out-of-bounds write vulnerability in .NET that could allow an attacker to execute code locally on a vulnerable host. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL exploit, no user interaction required? Actually user interaction is required per metrics. The vulnerability is...

CVE-2022-21986

CVE-2022-21986 is a .NET Denial of Service vulnerability in the Kestrel web server. The issue arises when processing certain HTTP/2 and HTTP/3 requests, enabling remote network-based DoS with low attack complexity. Affected products include .NET 6.0 up to 6.0.1 and .NET 5.0 up to 5.0.13. Remediat...

CVE-2023-35390

CVE-2023-35390 affects Microsoft .NET Core and Visual Studio runtimes used by IBM Robotic Process Automation for Cloud Pak. The IBM security bulletin confirms remote code execution via a user‑vectored payload: persuading a victim to open a specially crafted file could allow arbitrary code executi...

CVE-2022-24767

CVE-2022-24767 affects Git for Windows prior to 2.35.2, where the uninstaller is vulnerable to DLL hijacking when executed under the SYSTEM account. Root cause: uninstaller loads a malicious DLL from a user-writable path, enabling potential arbitrary code execution or compromise of the host as de...

CVE-2025-53773

CVE-2025-53773 describes a command-injection-based remote code execution risk in GitHub Copilot and Visual Studio. The root cause is improper neutralization of elements in prompts/config that Copilot can read and act on, potentially allowing an attacker to cause Copilot to modify project configur...

CVE-2023-38178

Summary: CVE-2023-38178 is a remote Denial of Service vulnerability in .NET Core/Visual Studio (notably affecting .NET 7.0 up to 7.0.9 and .NET 6 with HTTP/3 support). Connected advisories provide concrete mitigations and patched versions: for .NET 7.0, upgrade to 7.0.10 (and corresponding Runtim...

CVE-2025-24070

The CVE describes a weak authentication issue in ASP.NET Core and Visual Studio that could allow elevation of privilege via calls to RefreshSignInAsync with an improperly authenticated user parameter. Affected software includes ASP.NET Core apps using Microsoft.AspNetCore.Identity (affected versi...

CVE-2023-33126

CVE-2023-33126 is a .NET/Visual Studio vulnerability that could lead to remote code execution during crash/stack-trace scenarios. Microsoft’s advisory lists affected runtimes and patched versions: .NET 7.0.x up to 7.0.5 (update to 7.0.7), .NET 6.x up to 6.0.117 (update to 6.0.18). Affected packag...

CVE-2023-33135

Technical details for CVE-2023-33135 are not provided in the supplied documents. Connected sources reference this CVE but do not disclose affected products, root cause, impact, or fixes. Monitor for updates from Microsoft and security advisories.