CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24513 – Visual Studio Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2022-24513
Visual Studio Elevation of Privilege Vulnerability Una vulnerabilidad de Elevación de Privilegios en Visual Studio This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Visual Studio. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the VSIX Auto Update task. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24513 •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2022-24767
https://notcve.org/view.php?id=CVE-2022-24767
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. GitHub: El desinstalador de Git para Windows es vulnerable al secuestro de DLL cuando se ejecuta bajo la cuenta de usuario SYSTEM • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.8EPSS: 1%CPEs: 16EXPL: 0CVE-2022-24512 – .NET and Visual Studio Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-24512
.NET and Visual Studio Remote Code Execution Vulnerability Una vulnerabilidad de Ejecución de Código Remota en .NET y Visual Studio A flaw was found in dotnet, where a buffer overrun exists in the double parse routine, which could lead to remote code execution. This flaw allows an attacker to execute code remotely on the system, leading to some system compromise. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512 https://access.redhat.com/security/cve/CVE-2022-24512 https://bugzilla.redhat.com/show_bug.cgi?id=2061854 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2022-24464 – .NET and Visual Studio Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-24464
.NET and Visual Studio Denial of Service Vulnerability Una vulnerabilidad de Denegación de Servicio en .NET y Visual Studio A flaw was found in .NET Core, related to the FormPipeReader. This issue allows remote unauthenticated attackers to cause a denial of service. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464 https://access.redhat.com/security/cve/CVE-2022-24464 https://bugzilla.redhat.com/show_bug.cgi?id=2061847 • CWE-1173: Improper Use of Validation Framework •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-21986 – .NET Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-21986
.NET Denial of Service Vulnerability Una Vulnerabilidad de Denegación de Servicio en .NET A vulnerability was found in dotnet’s ASP.NET Core Krestel when pooling HTTP/2 and HTTP/3 headers. This flaw allows a remote, unauthenticated attacker to cause a denial of service. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21986 https://access.redhat.com/security/cve/CVE-2022-21986 https://bugzilla.redhat.com/show_bug.cgi?id=2051490 • CWE-770: Allocation of Resources Without Limits or Throttling •