CVSS: 8.8EPSS: 86%CPEs: 88EXPL: 7CVE-2020-1147 – Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-1147
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'. Se presenta una vulnerabilidad de ejecución de código remota en .NET Framework, Microsoft SharePoint y Visual Studio cuando el software presenta un fallo al comprobar el marcado de origen de una entrada de archivo XML, también se conoce como ".NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability" It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core application. Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content. • https://www.exploit-db.com/exploits/48747 https://www.exploit-db.com/exploits/50151 http://packetstormsecurity.com/files/158694/SharePoint-DataSet-DataTable-Deserialization.html http://packetstormsecurity.com/files/158876/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html http://packetstormsecurity.com/files/163644/Microsoft-SharePoint-Server-2019-Remote-Code-Execution.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1147 https://www.exploitalert.com/view-details.html?id=35992 h • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 132EXPL: 0CVE-2020-1108 – dotnet: Denial of service via untrusted input
https://notcve.org/view.php?id=CVE-2020-1108
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. Se presenta una vulnerabilidad denegación de servicio cuando .NET Core o .NET Framework manejan inapropiadamente las peticiones web, también se conoce como ".NET Core & .NET Framework Denial of Service Vulnerability" An integer overflow condition was found in dotnet and dotnet3.1's BinaryReader Read7BitEncodedInt() method. This method is used by BinaryReader's ReadString() method, and given a certain input, and cause a denial of service to dotnet applications using BinaryReader. The exploitation of this flaw depends on the application but does not inherently require the attacker to be authenticated or have any specific privileges. An attacker could exploit this flaw remotely via the internet by sending crafted data to a dotnet application that is passed into Read7BitEncodedInt(), resulting in a denial of service when the output is used by ReadString(). • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1108 https://access.redhat.com/security/cve/CVE-2020-1108 https://bugzilla.redhat.com/show_bug.cgi?id=1827643 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.3EPSS: 4%CPEs: 73EXPL: 0CVE-2020-0605
https://notcve.org/view.php?id=CVE-2020-0605
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606. Se presenta una vulnerabilidad de ejecución de código remota en el software .NET cuando el software presenta un fallo al comprobar el marcado de origen de un archivo. Un atacante que explota con éxito la vulnerabilidad podría ejecutar código arbitrario en el contexto del usuario actual, también se conoce como ".NET Framework Remote Code Execution Vulnerability". Este ID de CVE es diferente de CVE-2020-0606. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1302
https://notcve.org/view.php?id=CVE-2019-1302
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'. Se presenta una vulnerabilidad de elevación de privilegios cuando una aplicación web de ASP.NET Core, creada usando plantillas de proyecto vulnerables, no puede sanear apropiadamente las peticiones web, también se conoce como "ASP.NET Core Elevation Of Privilege Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1302 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1301 – dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service
https://notcve.org/view.php?id=CVE-2019-1301
A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'. Se presenta una vulnerabilidad de denegación de servicio cuando .NET Core maneja inapropiadamente las peticiones web, también se conoce como ".NET Core Denial of Service Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301 https://access.redhat.com/security/cve/CVE-2019-1301 https://bugzilla.redhat.com/show_bug.cgi?id=1750793 • CWE-20: Improper Input Validation •