Vulnerabilidades

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $,…

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Un uso después de liberar (use-after-free) en Windows Win32K permite a un atacante autorizado elevar privilegios localmente.

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.