Vulnerabilidades

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can…

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component,…

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an…

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious,…

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.