Microsoft Nugetgallery vulnerabilities

4 CVEs affecting Microsoft Nugetgallery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-54138, published 2024-12-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1340, published 2020-06-09. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'.
CVE-2024-47604, published 2024-10-01. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which allows an attacker to execute arbitrary…
CVE-2024-37304, published 2024-06-12. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly…
CVE-2024-54138, published 2024-12-06. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly…