Microsoft Nuget vulnerabilities

6 CVEs affecting Microsoft Nuget, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-29337, published 2023-06-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-30184, published 2022-06-15. Medium severity, CVSS 5.5. EPSS: 5.7% chance of exploitation in the next 30 days. .NET and Visual Studio Information Disclosure Vulnerability
• CVE-2019-1258, published 2019-08-14. High severity, CVSS 8.8. EPSS: 3.8% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated…
• CVE-2019-0757, published 2019-04-09. Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days. A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager…
• CVE-2019-0976, published 2019-05-16. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka…
• CVE-2023-29337, published 2023-06-14. High severity, CVSS 7.1. EPSS: 1.1% chance of exploitation in the next 30 days. NuGet Client Remote Code Execution Vulnerability
• CVE-2022-41064, published 2022-11-09. Medium severity, CVSS 5.8. EPSS: 0.8% chance of exploitation in the next 30 days. .NET Framework Information Disclosure Vulnerability