Vulnerabilidades

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

ASP.NET Security Feature Bypass Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

SUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.

SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.

.NET Core and Visual Studio Denial of Service Vulnerability

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

.NET Framework Remote Code Execution Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

ASP.NET Elevation of Privilege Vulnerability

.NET Framework Spoofing Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.