Search CVE reports
21 – 30 of 185 results
Some fixes available 6 of 8
Multipart form processing can bypass the configured header-count limit and consume excessive resources.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 1 of 2
The Blazor/SignalR /_blazor/refresh path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Not affected | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Not affected | Not affected | Not in release | Not in release |
| dotnet10 | Not affected | Not affected | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 2 of 4
Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Not affected | Not affected | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
Managed HttpListener can recursively process an unterminated request line and exhaust the process stack.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
The VSTest artifact postprocessor can consume a forged executionComplete.json from another local user and execute attacker-controlled output handling.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 6 of 8
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
5 affected packages
dotnet6, dotnet7, dotnet8, dotnet10, dotnet11
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |
Some fixes available 13 of 16
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory,...
7 affected packages
brotli, nodejs, dotnet6, dotnet7, dotnet8...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| brotli | Fixed | Fixed | Fixed | Fixed | Fixed |
| nodejs | Not affected | Not affected | Not affected | Vulnerable | Not affected |
| dotnet6 | Not in release | Not in release | Vulnerable | Not in release | Not in release |
| dotnet7 | Not in release | Not in release | Ignored | Not in release | Not in release |
| dotnet8 | Not in release | Fixed | Fixed | Not in release | Not in release |
| dotnet10 | Fixed | Fixed | Not in release | Not in release | Not in release |
| dotnet11 | Not in release | Not in release | Not in release | Not in release | Not in release |