| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally. |
| Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network. |
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
| Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. |
| A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.
The update addresses the vulnerability by correcting how the .NET web application handles web requests. |
| Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
| Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. |
| Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
