Nuget
Monthly
Sonatype Nexus Repository 3 fails to enforce a write-authorization check on the NuGet symbol-package upload path, letting an account that holds only repository read and browse privileges persist .snupkg symbol packages into a hosted NuGet repository. The defect is an integrity-only issue (I:H, with no confidentiality or availability impact) and is reachable by remote, low-privileged authenticated users (CVSS 4.0 7.1 High; assessed CVSS 3.1 7.1 High with PR:L). Exploitation is conditional: the target must be a hosted (not proxy or group) NuGet repository with the Symbol Server feature explicitly enabled, and where anonymous access is on, the built-in anonymous account already carries read and browse rights and satisfies the privilege prerequisite without any credential. No public exploit code was identified at time of analysis and there is no CISA KEV listing; a vendor fix is available.
NuGet Client Remote Code Execution Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable.
.NET Framework Information Disclosure Vulnerability. Rated medium severity (CVSS 5.8).
.NET and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Sonatype Nexus Repository 3 fails to enforce a write-authorization check on the NuGet symbol-package upload path, letting an account that holds only repository read and browse privileges persist .snupkg symbol packages into a hosted NuGet repository. The defect is an integrity-only issue (I:H, with no confidentiality or availability impact) and is reachable by remote, low-privileged authenticated users (CVSS 4.0 7.1 High; assessed CVSS 3.1 7.1 High with PR:L). Exploitation is conditional: the target must be a hosted (not proxy or group) NuGet repository with the Symbol Server feature explicitly enabled, and where anonymous access is on, the built-in anonymous account already carries read and browse rights and satisfies the privilege prerequisite without any credential. No public exploit code was identified at time of analysis and there is no CISA KEV listing; a vendor fix is available.
NuGet Client Remote Code Execution Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable.
.NET Framework Information Disclosure Vulnerability. Rated medium severity (CVSS 5.8).
.NET and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.