CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21386 – .NET Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-21386
.NET Denial of Service Vulnerability Vulnerabilidad de denegación de servicio de .NET A denial of service vulnerability is present in the .NET applications utilizing SignalR, which a malicious client can exploit. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service (DoS) attack by providing specially crafted input. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21386 https://access.redhat.com/security/cve/CVE-2024-21386 https://bugzilla.redhat.com/show_bug.cgi?id=2263085 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24682 – Automation Studio and PVI Multiple unquoted service path vulnerabilities
https://notcve.org/view.php?id=CVE-2020-24682
Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4. Vulnerabilidad de elemento o ruta de búsqueda sin comillas en B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI permite programas de destino con privilegios elevados. Este problema afecta a Automation Studio: desde 4.6.0 hasta 4.6.X, desde 4.7.0 antes de 4.7.7 SP , desde 4.8.0 antes de 4.8.6 SP, desde 4.9.0 antes de 4.9.4 SP; NET/PVI: desde 4.6.0 hasta 4.6.X, desde 4.7.0 antes de 4.7.7, desde 4.8.0 antes de 4.8.6, desde 4.9.0 antes de 4.9.4. • https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf • CWE-428: Unquoted Search Path or Element •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-21319 – Microsoft Identity Denial of service vulnerability
https://notcve.org/view.php?id=CVE-2024-21319
Microsoft Identity Denial of service vulnerability Vulnerabilidad de denegación de servicio de identidad de Microsoft A Denial of Service vulnerability was found in .NET Core project templates that utilize JWT-based authentication tokens. This issue may allow an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and making the server no longer able to respond to legitimate requests. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319 https://access.redhat.com/security/cve/CVE-2024-21319 https://bugzilla.redhat.com/show_bug.cgi?id=2257566 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 0CVE-2024-21312 – .NET Framework Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-21312
.NET Framework Denial of Service Vulnerability Vulnerabilidad de denegación de servicio de .NET Framework • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21312 https://security.netapp.com/advisory/ntap-20240208-0008 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 75EXPL: 0CVE-2024-0057 – NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-0057
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability Vulnerabididad en NET, .NET Framework y Visual Studio Security Feature Bypass A security feature bypass vulnerability exists when Microsoft .NET Framework-based applications use X.509 chain building APIs but do not completely validate the X.509 certificate due to a logic flaw. An attacker could present an arbitrary untrusted certificate with malformed signatures, triggering a bug in the framework. The framework will correctly report that X.509 chain building failed, but it will return an incorrect reason code for the failure. Applications which utilize this reason code to make their own chain building trust decisions may inadvertently treat this scenario as a successful chain build. This could allow an adversary to subvert the app's typical authentication logic. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057 https://security.netapp.com/advisory/ntap-20240208-0007 https://access.redhat.com/security/cve/CVE-2024-0057 https://bugzilla.redhat.com/show_bug.cgi?id=2255386 • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •