Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 471

Export CSV
CVE-2025-62214

Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.

CVSS 3.1 · 6.7 Medium EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2022
CVE-2025-64660

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2020-1597

ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Fedoraproject Microsoft Redhat
Products
Fedora Asp.net Core Visual Studio 2017 and 3 more
CVE-2020-1133

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

<p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p> <p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p> <p>The update addresses the vulnerability by correcting the way the Diagnostics Hub Standard Collector handles file operations.</p>

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2017 Visual Studio 2019 and 11 more
CVE-2020-1130

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

<p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles data operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p> <p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p> <p>The update addresses the vulnerability by correcting the way the Diagnostics Hub Standard Collector handles data operations.</p>

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2017 Visual Studio 2019 and 11 more
CVE-2020-17023

Visual Studio JSON Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p> <p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2020-16977

Visual Studio Code Python Extension Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p> <p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>

CVSS 3.1 · 7 High EPSS 3.4% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2020-16881

Visual Studio JSON Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p> <p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>

CVSS 3.1 · 7.8 High EPSS 5.4% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2020-16874

Visual Studio Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>

CVSS 3.1 · 7.8 High EPSS 4.3% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2017 Visual Studio 2019
CVE-2020-16856

Visual Studio Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted file with an affected version of Visual Studio.</p> <p>The update addresses the vulnerability by correcting how Visual Studio handles objects in memory.</p>

CVSS 3.1 · 7.8 High EPSS 4.4% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2017 Visual Studio 2019
CVE-2020-0604

Visual Studio Code Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opened the integrated terminal. The update address the vulnerability by modifying the way Visual Studio Code handles environment variables.

CVSS 3.1 · 7.8 High EPSS 3.6% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Code
CVE-2025-55248

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 19 more
CVE-2019-1211

Git for Visual Studio Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files. An attacker who successfully exploited the vulnerability could execute code in the context of another local user. To exploit the vulnerability, an authenticated attacker would need to modify Git configuration files on a system prior to a full installation of the application. The attacker would then need to convince another user on the system to execute specific Git commands. The update addresses the issue by changing the permissions required to edit configuration files.

CVSS 3.0 · 7.3 High EPSS 1.7% KEV · Not listed
Vendors
Microsoft
Products
Powershell Core Visual Studio 2017 Visual Studio 2019
CVE-2025-47959

Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.1 High EPSS 11.4% KEV · Not listed
Vendors
Microsoft
Products
Visual Studio Visual Studio 2022
CVE-2025-30399

.NET and Visual Studio Remote Code Execution Vulnerability

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 5 more
CVE-2025-62453

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Github Microsoft
Products
Copilot Visual Studio Code