Asp Net Core
Monthly
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated, network-based attacker to execute arbitrary script in a victim's browser session by getting attacker-influenced input rendered into a web page without proper HTML neutralization. Affected are applications built on Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 through <10.0.13, as well as apps produced by the vulnerable Microsoft Visual Studio 2026 18.10.x (<18.10.4) and Visual Studio 2022 17.14.x (<17.14.42) toolchains. Exploitation is not automatable per CISA SSVC and requires mandatory user interaction (CVSS UI:R) - the victim must load or interact with the crafted content - and no public exploit code or active exploitation has been identified at time of analysis; vendor patches are available, so risk is primarily to unpatched, internet-facing Blazor WebAssembly deployments.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.
Uncontrolled resource allocation in ASP.NET Core enables unauthenticated remote attackers to exhaust system resources and cause denial of service without requiring user interaction. The vulnerability affects .NET applications exposed to network access, allowing attackers to trigger unbounded resource consumption from any network location. A patch is available to address this issue.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A denial-of-service condition in ASP.NET Core allows an unauthenticated, remote attacker to exhaust server CPU by submitting HTTP form data in many small increments, causing Microsoft.AspNetCore.WebUtilities FormPipeReader to repeatedly rescan the entire buffered request body. The flaw (CWE-407, inefficient algorithmic complexity) affects applications running ASP.NET Core 8.0.0-8.0.31, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, and carries a CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted - there is no data disclosure or modification - and the high attack-complexity rating reflects the need for an incrementally delivered body rather than a single malformed request. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 47.0% and no vendor patch available.
ASP.NET Core Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ASP.NET Core Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
ASP.NET Core and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ASP.NET Core and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
ASP.NET Core 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Alpine Linux: dotnet8-runtime fixed in 8.0.2-r0
Alpine Linux: dotnet8-runtime fixed in 8.0.2-r0
ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchronize HTTP request framing between Kestrel and an upstream proxy or CDN, potentially leading to credential theft, cache poisoning, access-control bypass, and other downstream compromise; the vector scores 9.9 with scope change and high confidentiality/integrity impact. Affected deployments include ASP.NET Core/Kestrel applications and Alpine's dotnet8-runtime before 8.0.21-r0, with CPE data also associating Visual Studio 2022. Publicly available exploit code exists, EPSS is 1.68% (82nd percentile), and no CISA KEV confirmation was provided.
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Cross-site scripting (CWE-79) in the ASP.NET Core Blazor WebAssembly Server hosting component allows an unauthenticated, network-based attacker to execute arbitrary script in a victim's browser session by getting attacker-influenced input rendered into a web page without proper HTML neutralization. Affected are applications built on Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 through <10.0.13, as well as apps produced by the vulnerable Microsoft Visual Studio 2026 18.10.x (<18.10.4) and Visual Studio 2022 17.14.x (<17.14.42) toolchains. Exploitation is not automatable per CISA SSVC and requires mandatory user interaction (CVSS UI:R) - the victim must load or interact with the crafted content - and no public exploit code or active exploitation has been identified at time of analysis; vendor patches are available, so risk is primarily to unpatched, internet-facing Blazor WebAssembly deployments.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Account takeover is possible in applications built on ASP.NET Core Identity because the framework's password-reset and email-confirmation flows can dispatch mail to the unvalidated address supplied in the incoming request rather than the user's stored canonical address, allowing a remote unauthenticated attacker who can influence that request address to intercept recovery tokens and reset victim credentials. The issue affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI deployments running on ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as certain Visual Studio 2022 and Visual Studio 2026 builds that bundle the affected runtime; it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-640. No public exploit code was identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be treated as a high-priority patching item rather than an active-exploitation emergency.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.
Uncontrolled resource allocation in ASP.NET Core enables unauthenticated remote attackers to exhaust system resources and cause denial of service without requiring user interaction. The vulnerability affects .NET applications exposed to network access, allowing attackers to trigger unbounded resource consumption from any network location. A patch is available to address this issue.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
A denial-of-service condition in ASP.NET Core allows an unauthenticated, remote attacker to exhaust server CPU by submitting HTTP form data in many small increments, causing Microsoft.AspNetCore.WebUtilities FormPipeReader to repeatedly rescan the entire buffered request body. The flaw (CWE-407, inefficient algorithmic complexity) affects applications running ASP.NET Core 8.0.0-8.0.31, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, and carries a CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted - there is no data disclosure or modification - and the high attack-complexity rating reflects the need for an incrementally delivered body rather than a single malformed request. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 47.0% and no vendor patch available.
ASP.NET Core Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ASP.NET Core Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
ASP.NET Core and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
ASP.NET Core and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
ASP.NET Core 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Alpine Linux: dotnet8-runtime fixed in 8.0.2-r0
Alpine Linux: dotnet8-runtime fixed in 8.0.2-r0
ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchronize HTTP request framing between Kestrel and an upstream proxy or CDN, potentially leading to credential theft, cache poisoning, access-control bypass, and other downstream compromise; the vector scores 9.9 with scope change and high confidentiality/integrity impact. Affected deployments include ASP.NET Core/Kestrel applications and Alpine's dotnet8-runtime before 8.0.21-r0, with CPE data also associating Visual Studio 2022. Publicly available exploit code exists, EPSS is 1.68% (82nd percentile), and no CISA KEV confirmation was provided.