Microsoft .net Core vulnerabilities

32 CVEs affecting Microsoft .net Core, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-41032, published 2022-10-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability, published 2020-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 94% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,…
• CVE-2021-26701, published 2021-02-25. High severity, CVSS 8.1. EPSS: 30.1% chance of exploitation in the next 30 days. .NET Core Remote Code Execution Vulnerability
• CVE-2020-0605, published 2020-01-14. High severity, CVSS 8.8. EPSS: 17.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary…
• CVE-2020-0606, published 2020-01-14. High severity, CVSS 8.8. EPSS: 17.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary…
• CVE-2019-0545, published 2019-01-08. High severity, CVSS 7.5. EPSS: 9.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure…
• CVE-2018-0764, published 2018-01-10. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents…
• CVE-2018-0765, published 2018-05-09. High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days. A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0,…
• CVE-2018-8409, published 2018-09-13. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET…
• CVE-2020-1108, published 2020-05-21. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service…
• CVE-2019-0820, published 2019-05-16. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique…

Latest

• CVE-2022-41032, published 2022-10-11. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. NuGet Client Elevation of Privilege Vulnerability
• CVE-2022-38013, published 2022-09-13. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2022-34716, published 2022-08-09. Medium severity, CVSS 5.9. EPSS: 2.4% chance of exploitation in the next 30 days. .NET Spoofing Vulnerability
• CVE-2022-30184, published 2022-06-15. Medium severity, CVSS 5.5. EPSS: 5.7% chance of exploitation in the next 30 days. .NET and Visual Studio Information Disclosure Vulnerability
• CVE-2022-29145, published 2022-05-10. High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days. .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-29117, published 2022-05-10. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-23267, published 2022-05-10. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. .NET and Visual Studio Denial of Service Vulnerability
• CVE-2022-24512, published 2022-03-09. Medium severity, CVSS 6.3. EPSS: 1.6% chance of exploitation in the next 30 days. .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2022-24464, published 2022-03-09. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. .NET and Visual Studio Denial of Service Vulnerability
• CVE-2021-34485, published 2021-08-12. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. .NET Core and Visual Studio Information Disclosure Vulnerability