CVSS: 7.5EPSS: 83%CPEs: 444EXPL: 7CVE-2023-44487 – HTTP/2 Rapid Reset Attack Vulnerability
https://notcve.org/view.php?id=CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023. A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. • https://github.com/imabee101/CVE-2023-44487 https://github.com/studiogangster/CVE-2023-44487 https://github.com/bcdannyboy/CVE-2023-44487 https://github.com/sigridou/CVE-2023-44487- https://github.com/ByteHackr/CVE-2023-44487 https://github.com/ReToCode/golang-CVE-2023-44487 http://www.openwall.com/lists/oss-security/2023/10/13/4 http://www.openwall.com/lists/oss-security/2023/10/13/9 http://www.openwall.com/lists/oss-security/2023/10/18/4 http://www. • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.3EPSS: 4%CPEs: 73EXPL: 0CVE-2020-0605
https://notcve.org/view.php?id=CVE-2020-0605
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606. Se presenta una vulnerabilidad de ejecución de código remota en el software .NET cuando el software presenta un fallo al comprobar el marcado de origen de un archivo. Un atacante que explota con éxito la vulnerabilidad podría ejecutar código arbitrario en el contexto del usuario actual, también se conoce como ".NET Framework Remote Code Execution Vulnerability". Este ID de CVE es diferente de CVE-2020-0606. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2019-0980 – dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service
https://notcve.org/view.php?id=CVE-2019-0980
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981. Existe una vulnerabilidad de Denegación de Servicio (DoS) cuando .NET Framework o .NET Core manejan inapropiadamente las solicitudes web, también conocidas como '.Net Framework y .Net Core Denial of Service Vulnerability'. Este ID de CVE es diferente de CVE-2019-0820, CVE-2019-0981. • https://access.redhat.com/errata/RHSA-2019:1259 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980 https://access.redhat.com/security/cve/CVE-2019-0980 https://bugzilla.redhat.com/show_bug.cgi?id=1705502 • CWE-19: Data Processing Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2019-0981 – dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service
https://notcve.org/view.php?id=CVE-2019-0981
A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980. Existe una vulnerabilidad de Denegación de Servicio (DoS) cuando .NET Framework o .NET Core manejan inapropiadamente las solicitudes web, también conocidas como '.Net Framework y .Net Core Denial of Service Vulnerability'. Este ID de CVE es diferente de CVE-2019-0820, CVE-2019-0980. • https://access.redhat.com/errata/RHSA-2019:1259 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981 https://access.redhat.com/security/cve/CVE-2019-0981 https://bugzilla.redhat.com/show_bug.cgi?id=1705504 • CWE-19: Data Processing Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 95EXPL: 0CVE-2019-0820 – dotnet: timeouts for regular expressions are not enforced
https://notcve.org/view.php?id=CVE-2019-0820
A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981. Existe una vulnerabilidad de Denegación de Servicio (DoS) cuando .NET Framework y .NET Core procesan inapropiadamente cadenas RegEx, conocidas como ".NET Framework y .NET Core Denial of Service Vulnerability". Este ID de CVE es diferente de CVE-2019-0980, CVE-2019-0981. • https://access.redhat.com/errata/RHSA-2019:1259 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0820 https://access.redhat.com/security/cve/CVE-2019-0820 https://bugzilla.redhat.com/show_bug.cgi?id=1705506 • CWE-400: Uncontrolled Resource Consumption •