.NET Framework vulnerabilities

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

Microsoft .NET Framework versions 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service.

Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'

The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.

Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, allowing remote attackers to cause a denial of service via crafted XSLT data.

Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.

A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.

The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, allowing remote attackers to execute arbitrary code via malformed objects.

Microsoft .NET Framework versions 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandle signature validation for unspecified elements of XML documents, allowing remote attackers to spoof signatures via a modified document.

Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

Code injection vulnerability in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Resource allocation without limits or throttling in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

A protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Stack-based buffer overflow in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

Improper input type validation in .NET Framework allows an unauthorized attacker to cause a remote denial of service (DoS).

HCL Traveler for Microsoft Outlook (HTMO) is vulnerable due to the use of .NET Framework 4.5, which has reached end-of-life and no longer receives security updates. This may expose the application to publicly known security weaknesses through vulnerable third-party components.

A race condition in .NET Framework when using shared resources concurrently allows an unauthorized attacker to cause a denial of service over the network.

A vulnerability in .NET Framework due to improper input validation allows an unauthorized attacker to cause a denial of service (DoS) over a network.

.NET Framework vulnerability allows spoofing, potentially leading to unauthorized access to systems or data.

Denial of service vulnerability in .NET Framework.

A vulnerability in .NET Framework allows information disclosure. An attacker could exploit this flaw to access data that should be protected.

An elevation of privilege vulnerability in .NET Framework could allow an attacker to elevate their privilege level. To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program. The update addresses the vulnerability by correcting how .NET Framework activates COM objects.