Nuget vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nuget products: 65 record(s), with severity, exploitation and fixes.

Microsoft.WindowsDesktop.App.Runtime.win-x86 10 Microsoft.WindowsDesktop.App.Runtime.win-x64 10 Microsoft.WindowsDesktop.App.Runtime.win-arm64 10 Microsoft.AspNetCore.App.Runtime.win-arm64 9 Microsoft.AspNetCore.App.Runtime.win-x64 9 Microsoft.AspNetCore.App.Runtime.win-x86 9 Microsoft.NETCore.App.Runtime.linux-arm64 8 Microsoft.NETCore.App.Runtime.osx-x64 8 Microsoft.NETCore.App.Runtime.linux-x64 8 Microsoft.NETCore.App.Runtime.linux-musl-x64 8 Microsoft.NETCore.App.Runtime.linux-musl-arm64 8 Microsoft.NETCore.App.Runtime.linux-arm 8 Microsoft.AspNetCore.App.Runtime.linux-arm 8 Microsoft.AspNetCore.App.Runtime.linux-arm64 8 Microsoft.AspNetCore.App.Runtime.linux-musl-arm 8 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 8 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 8 Microsoft.AspNetCore.App.Runtime.linux-x64 8 Microsoft.AspNetCore.App.Runtime.osx-arm64 8 Microsoft.AspNetCore.App.Runtime.osx-x64 8 Microsoft.NETCore.App.Runtime.osx-arm64 7 Microsoft.NETCore.App.Runtime.linux-musl-arm 7 Microsoft.NETCore.App.Runtime.win-arm64 6 Microsoft.NETCore.App.Runtime.win-x64 6 Microsoft.NETCore.App.Runtime.win-x86 6 CefSharp.Common 5 CefSharp.Wpf.HwndHost 5 CefSharp.Wpf 5 CefSharp.WinForms 5 TinyMCE 4 System.Security.Cryptography.Xml 4 Microsoft.AspNetCore.App.Runtime.win-arm 4 DotNetNuke.Core 3 Microsoft.ChakraCore 3 Microsoft.NETCore.App.Runtime.win-arm 3 System.Security.Cryptography.Pkcs 2 Microsoft.AspNetCore.Components.WebAssembly.Server 2 Microsoft.Native.Quic.MsQuic.Schannel 2 CefSharp.Common.NETCore 1 MessagePack 1

Exploited only (KEV) →

CVE-2023-38180 High · 7.5 KEV High · 58 CWE-400 Aug 8, 2023

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

CVE-2022-0609 High · 8.8 KEV High · 66 CWE-416 Apr 4, 2022

Google Chromium Animation Use-After-Free Vulnerability

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-23758 Critical · 9.8 KEV Urgent · 78 Public exploit CWE-502 Dec 3, 2021

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

CVE-2020-16013 High · 8.8 KEV High · 54 CWE-787 Jan 8, 2021

Google Chromium V8 Incorrect Implementation Vulnerabililty

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-16017 Critical · 9.6 KEV High · 58 CWE-416 Jan 8, 2021

Google Chrome Use-After-Free Vulnerability

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-16009 High · 8.8 KEV High · 56 CWE-787 Nov 3, 2020

Google Chromium V8 Type Confusion Vulnerability

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-15999 Critical · 9.6 KEV High · 66 Public exploit CWE-787 Nov 3, 2020

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-1147 High · 7.8 KEV Urgent · 76 Public exploit Jul 14, 2020

Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

CVE-2020-11023 Medium · 6.1 KEV High · 67 Public exploit CWE-79 Apr 29, 2020

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2018-18325 High · 7.5 KEV Urgent · 79 Public exploit CWE-326 Jul 3, 2019

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

CVE-2018-15811 High · 7.5 KEV Urgent · 79 Public exploit CWE-326 Jul 3, 2019

DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

CVE-2018-8298 High · 7.5 KEV High · 64 Public exploit CWE-843 Jul 10, 2018

ChakraCore Scripting Engine Type Confusion Vulnerability

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

CVE-2017-9822 High · 8.8 KEV Urgent · 86 Public exploit Ransomware CWE-94 Jul 20, 2017

DotNetNuke (DNN) Remote Code Execution Vulnerability

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

CVE-2016-7201 High · 8.8 KEV High · 64 Public exploit CWE-843 Nov 10, 2016

Microsoft Edge Memory Corruption Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

CVE-2016-7200 High · 8.8 KEV Urgent · 70 Public exploit CWE-787 Nov 10, 2016

Microsoft Edge Memory Corruption Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.