Vulnerabilidades

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler `Gemfile` used at startup. A malicious repository containing…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be…

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to…

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's…

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.