CVSS: 8.7EPSS: 0%CPEs: 77EXPL: 0CVE-2024-0056 – Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Vulnerabilidad de omisión de característica de seguridad del proveedor de datos SQL de Microsoft.Data.SqlClient y System.Data.SqlClient A vulnerability was found in the .NET Framework. This vulnerability exists in the Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data provider where an attackercan perform an AiTM (adversary-in-the-middle) attack between the SQL client and the SQL server. This may allow the attacker to steal authentication credentials intended for the database server, even if the connection is established over an encrypted channel like TLS. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 https://access.redhat.com/security/cve/CVE-2024-0056 https://bugzilla.redhat.com/show_bug.cgi?id=2255384 • CWE-319: Cleartext Transmission of Sensitive Information CWE-420: Unprotected Alternate Channel •
CVSS: 8.2EPSS: 0%CPEs: 14EXPL: 0CVE-2023-36038 – ASP.NET Core Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2023-36038
ASP.NET Core Denial of Service Vulnerability Vulnerabilidad de denegación de servicio de ASP.NET Core • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36038 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.2EPSS: 0%CPEs: 11EXPL: 0CVE-2023-36558 – ASP.NET Core - Security Feature Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-36558
ASP.NET Core - Security Feature Bypass Vulnerability Vulnerabilidad de omisión de funciones de seguridad en ASP.NET Core A security feature bypass vulnerability was found in Blazor forms in ASP.NET in the .NET package. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558 https://access.redhat.com/security/cve/CVE-2023-36558 https://bugzilla.redhat.com/show_bug.cgi?id=2247750 •
CVSS: 9.8EPSS: 0%CPEs: 82EXPL: 0CVE-2023-36049 – .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2023-36049
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Vulnerabilidad de elevación de privilegios en .NET, .NET Framework y Visual Studio A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion. This vulnerability allows remote attackers to create or delete arbitrary files on FTP servers implemented using affected versions of Microsoft .NET. Interaction with the .NET framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the FormatFtpCommand method. The issue results from the incorrect neutralization of CRLF sequences. An attacker can leverage this vulnerability to write or delete files in the context of the FTP server. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049 https://access.redhat.com/security/cve/CVE-2023-36049 https://bugzilla.redhat.com/show_bug.cgi?id=2248883 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •