Microsoft PowerShell Core vulnerabilities

18 CVEs affecting Microsoft PowerShell Core, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34485, published 2021-08-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-26701, published 2021-02-25. High severity, CVSS 8.1. EPSS: 30.1% chance of exploitation in the next 30 days. .NET Core Remote Code Execution Vulnerability
• CVE-2018-8256, published 2018-11-14. High severity, CVSS 8.8. EPSS: 22.6% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Code Execution Vulnerability." This affects Windows RT 8.1,…
• CVE-2018-8292, published 2018-10-10. High severity, CVSS 7.5. EPSS: 14.8% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects…
• CVE-2018-0875, published 2018-03-14. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service…
• CVE-2018-0764, published 2018-01-10. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents…
• CVE-2020-1108, published 2020-05-21. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service…
• CVE-2019-1301, published 2019-09-11. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.
• CVE-2019-0657, published 2019-03-05. Medium severity, CVSS 5.9. EPSS: 4.5% chance of exploitation in the next 30 days. A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.
• CVE-2021-26423, published 2021-08-12. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2018-0786, published 2018-01-10. High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days. Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the…

Latest

• CVE-2021-34485, published 2021-08-12. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. .NET Core and Visual Studio Information Disclosure Vulnerability
• CVE-2021-1721, published 2021-02-25. Medium severity, CVSS 6.5. EPSS: 3.3% chance of exploitation in the next 30 days. .NET Core and Visual Studio Denial of Service Vulnerability
• CVE-2019-1167, published 2019-07-19. Medium severity, CVSS 4.1. EPSS: 1.1% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control…
• CVE-2019-0632, published 2019-03-05. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from…
• CVE-2019-0631, published 2019-03-05. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from…