Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34

Export CSV
CVE-2020-0606

dotnet: Malfunctioning StickyNotes annotation XML files malicious execution prevetion

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.

CVSS 3.1 · 8.8 High EPSS 18.3% KEV · Not listed
Vendors
Microsoft
Products
.net Core .net Framework Windows 10 and 7 more
CVE-2020-0605

dotnet: Bypass of WPF XAML payload prevention

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.

CVSS 3.1 · 8.8 High EPSS 18.4% KEV · Not listed
Vendors
Microsoft
Products
.net Core .net Framework Windows 10 and 7 more
CVE-2019-0981

dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.

CVSS 3.0 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Windows 10 and 9 more
CVE-2019-0980

dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.

CVSS 3.0 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Windows 10 and 9 more
CVE-2019-0820

dotnet: timeouts for regular expressions are not enforced

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

CVSS 3.1 · 7.5 High EPSS 5.7% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Windows 10 and 12 more
CVE-2019-0757

dotnet: NuGet Tampering Vulnerability

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Microsoft Mono-project and 1 more
Products
Macos .net Core .net Core Sdk and 8 more
CVE-2019-0657

dotnet: Domain-spoofing attack in System.Uri

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

CVSS 3.0 · 5.9 Medium EPSS 4.6% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Powershell Core and 10 more
CVE-2019-0545

Core: NCL - SocketsHttpHandler mishandling 1xx response as a final response leads to info disclosure

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.

CVSS 3.0 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Windows 10 and 9 more
CVE-2018-8409

NET: Resource loop in ReadAsync when it is being cancelled while producer allocates memory using GetMemory

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Microsoft
Products
.net Core Asp.net Core System.io.pipelines
CVE-2018-8356

Core: incorrect certificates validation

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
.net Core .net Framework .net Framework Developer Pack and 10 more
CVE-2018-0786

ASP.NET: Incorrect certificate validation can allow attackers to bypass security checks

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

CVSS 3.0 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Microsoft
Products
.net Core .net Framework Powershell Core and 7 more
CVE-2018-0765

dotnet: Improper processing of XML documents can allow a remote attacker to cause a denial of service

A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.

CVSS 3.0 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Microsoft
Products
.net Core .net Framework Windows 10 and 6 more
CVE-2018-0764

Core: Improper processing of XML documents can cause a denial of service

Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Microsoft Redhat
Products
.net Core .net Framework Powershell Core and 8 more