Skip to content

microsoft.aspnetcore.2.0.1.nupkg: 14 vulnerabilities (highest severity is: 9.4) [master] (reachable) #61

Open
Open
microsoft.aspnetcore.2.0.1.nupkg: 14 vulnerabilities (highest severity is: 9.4) [master] (reachable)#61

Description

@mend-developer-platform-dev
mend-developer-platform-dev
bot
opened on Sep 28, 2025
📂 Vulnerable Library - microsoft.aspnetcore.2.0.1.nupkg

Microsoft.AspNetCore

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore/2.0.1/microsoft.aspnetcore.2.0.1.nupkg

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2025-55315 🟣 Critical 9.4 Unproven < 1% microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg Transitive N/A ❌ Unreachable
CVE-2021-26701 🟣 Critical 9.2 Unproven 1.7% system.text.encodings.web.4.4.0.nupkg Transitive N/A ❌ Reachable
CVE-2017-11770 🔴 High 8.7 Not Defined 13.0% microsoft.aspnetcore.2.0.1.nupkg Direct System.Security.Cryptography.X509Certificates - 4.1.2,Microsoft.NETCore.App - 2.0.3 ✅ Unreachable
CVE-2018-0787 🔴 High 8.7 Not Defined 13.7% microsoft.aspnetcore.httpoverrides.2.0.1.nupkg Transitive N/A ❌ Unreachable
CVE-2018-0787 🔴 High 8.7 Not Defined 13.7% microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg Transitive N/A ❌ Unreachable
CVE-2018-0808 🔴 High 8.7 Not Defined 9.9% microsoft.aspnetcore.hosting.2.0.1.nupkg Transitive N/A ❌ Reachable
CVE-2018-0808 🔴 High 8.7 Not Defined 9.9% microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg Transitive N/A ❌ Reachable
CVE-2024-21907 🔴 High 8.7 Not Defined 3.9% newtonsoft.json.11.0.2.nupkg Direct Newtonsoft.Json - 13.0.1 ✅
CVE-2020-1045 🔴 High 7.7 Proof of concept 20.4% microsoft.aspnetcore.http.2.0.1.nupkg Transitive N/A ❌ Unreachable
CVE-2023-38180 🔴 High 7.7 Proof of concept < 1% microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg Transitive N/A ❌
WS-2018-0607 🔴 High 7.5 N/A N/A microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg Transitive N/A ❌ Unreachable
WS-2018-0608 🔴 High 7.5 N/A N/A microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg Transitive N/A ❌ Unreachable
WS-2018-0608 🔴 High 7.5 N/A N/A microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg Transitive N/A ❌ Unreachable
WS-2018-0608 🔴 High 7.5 N/A N/A microsoft.aspnetcore.server.kestrel.transport.abstractions.2.0.1.nupkg Transitive N/A ❌ Unreachable

Details

🟣CVE-2025-55315

Vulnerable Library - microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Core components of ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.core/2.0.1/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. Discussion Discussion for this issue can be found at dotnet/announcements#372 Mitigation factors Microsoft has not identified any mitigating factors for this vulnerability. Affected software * Any ASP.NET Core 10.0 application running on ASP.NET Core 10.0.0-rc.1.25451.107 or earlier. * Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.9 or earlier. * Any ASP.NET Core application running on ASP.NET Core 8.0.20 or earlier. * Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.0 or earlier. Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- "Microsoft.AspNetCore.Server.Kestrel.Core" (https://www.nuget.org/packages/Microsoft.AspNetCore.Server.Kestrel.Core) | <= 2.3.0 | 2.3.6 ASP.NET Core 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- "Microsoft.AspNetCore.App.Runtime.linux-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.linux-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.linux-musl-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.linux-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.osx-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.osx-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.win-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.win-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.win-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 "Microsoft.AspNetCore.App.Runtime.win-x86" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 ASP.NET Core 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- "Microsoft.AspNetCore.App.Runtime.linux-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.linux-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.linux-musl-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.linux-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.osx-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.osx-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.win-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.win-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.win-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.9 | 9.0.10 "Microsoft.AspNetCore.App.Runtime.win-x86" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.9 | 9.0.10 ASP.NET Core 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- "Microsoft.AspNetCore.App.Runtime.linux-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.linux-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.linux-musl-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.linux-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.osx-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.osx-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.win-arm" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.win-arm64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.win-x64" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.20 | 8.0.21 "Microsoft.AspNetCore.App.Runtime.win-x86" (https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.20 | 8.0.21 Advisory FAQ How do I know if I am affected? If you have a runtime or SDK with a version listed, or an affected package listed in "affected software" (#affected-packages) or "affected packages" (#affected-software), you're exposed to the vulnerability. How do I fix the issue? 1. To fix the issue please install the latest version of .NET 9.0 and .NET 8.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version. * You can list the versions you have installed by running the "dotnet --info" command. You will see output like the following; .NET SDK: Version: 9.0.100 Commit: 59db016f11 Workload version: 9.0.100-manifests.3068a692 MSBuild version: 17.12.7+5b8665660 Runtime Environment: OS Name: Mac OS X OS Version: 15.2 OS Platform: Darwin RID: osx-arm64 Base Path: /usr/local/share/dotnet/sdk/9.0.100/ .NET workloads installed: There are no installed workloads to display. Configured to use loose manifests when installing new manifests. Host: Version: 9.0.0 Architecture: arm64 Commit: 9d5a6a9aa4 .NET SDKs installed: 9.0.100 [/usr/local/share/dotnet/sdk] .NET runtimes installed: Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App] Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App] Other architectures found: x64 [/usr/local/share/dotnet] registered at [/etc/dotnet/install_location_x64] Environment variables: Not set global.json file: Not found Learn more: https://aka.ms/dotnet/info Download .NET: https://aka.ms/dotnet/download * If you're using .NET 8.0, you should download and install .NET 8.0.21 Runtime or .NET 8.0.318 SDK (for Visual Studio 2022 v17.10 latest update) from https://dotnet.microsoft.com/download/dotnet-core/8.0. * If you're using .NET 9.0, you should download and install .NET 9.0.10 Runtime or .NET 9.0.111 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/9.0. * If you're using .NET 10.0, you should download and install .NET 10.0.0-rc.2.25476.107 Runtime or .NET 10.0.100-rc.2.25476.107 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/10.0. * If you're using "Microsoft.AspNetCore.Server.Kestrel.Core" (https://www.nuget.org/packages/Microsoft.AspNetCore.Server.Kestrel.Core) nuget package, update to the latest version 2.3.6 using either of the following methods: * Using the NuGet Package Manager UI in Visual Studio: - Open your project in Visual Studio. - Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. - Click the "Update" button. * Using the NuGet Package Manager Console in Visual Studio: - Open your project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, use the Update-Package command: Code: Update-Package -Id Microsoft.AspNetCore.Server.Kestrel.Core * Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version: Code: dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core Once you have installed the updated runtime or SDK, restart your apps for the update to take effect. Additionally, if you've deployed "self-contained applications" (https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. Other Information Reporting Security Issues If you have found a potential security issue in .NET 8.0, .NET 9.0 or .NET 10.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at "https://aka.ms/corebounty" (https://aka.ms/corebounty). Support You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue. Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links Acknowledgement Sid "CVE-2025-55315" (https://www.cve.org/CVERecord?id=CVE-2025-55315) Revisions V1.0 (October 14, 2025): Advisory published. Version 1.0 Last Updated 2025-10-14

Publish Date: Oct 14, 2025 11:52 PM

URL: CVE-2025-55315

Threat Assessment

Exploit Maturity:Unproven

EPSS:< 1%

Score: 9.4

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟣CVE-2021-26701

Vulnerable Library - system.text.encodings.web.4.4.0.nupkg

Provides types for encoding and escaping strings for use in JavaScript, HyperText Markup Language (H...

Library home page: https://api.nuget.org/packages/system.text.encodings.web.4.4.0.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.encodings.web/4.4.0/system.text.encodings.web.4.4.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.identity.entityframeworkcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.identity.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.cookies.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.2.0.1.nupkg
          • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
            • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
              • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
                • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.azureappservices.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.session.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
        • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.responsecaching.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.server.httpsys.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
      • microsoft.aspnetcore.http.2.0.1.nupkg
        • microsoft.aspnetcore.webutilities.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.diagnostics.entityframeworkcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.middlewareanalysis.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.diagnostics.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.rewrite.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.localization.routing.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.routing.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.applicationinsights.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.razor.runtime.2.0.1.nupkg
      • microsoft.aspnetcore.html.abstractions.2.0.0.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.dataprotection.azurestorage.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
        • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.websockets.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.extensions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.staticfiles.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.cookiepolicy.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.visualstudio.web.browserlink.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
      • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.formatters.xml.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
      • microsoft.aspnetcore.routing.2.0.1.nupkg
        • microsoft.aspnetcore.routing.abstractions.2.0.1.nupkg
          • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
            • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.owin.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.2.0.1.nupkg
      • microsoft.aspnetcore.webutilities.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.responsecompression.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.http.extensions.2.0.1.nupkg
      • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
        • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.dataprotection.extensions.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
        • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.2.0.1.nupkg
      • microsoft.aspnetcore.http.2.0.1.nupkg
        • microsoft.aspnetcore.webutilities.2.0.1.nupkg
          • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.dataprotection.2.0.1.nupkg
          • microsoft.aspnetcore.hosting.abstractions.2.0.1.nupkg
            • microsoft.aspnetcore.http.abstractions.2.0.1.nupkg
              • ❌ system.text.encodings.web.4.4.0.nupkg (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- dvcsharp_core_api.AuthorizationsController (Application)
    - Microsoft.AspNetCore.Mvc.Controller (Extension)
        - Microsoft.AspNetCore.Http.HttpContext (Extension)
            - Microsoft.AspNetCore.Http.HttpRequest (Extension)
                - Microsoft.AspNetCore.Http.QueryString (Extension)
                    -> ❌ System.Text.Encodings.Web.TextEncoder (Vulnerable Component)

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: Feb 25, 2021 11:02 PM

URL: CVE-2021-26701

Threat Assessment

Exploit Maturity:Unproven

EPSS:1.7%

Score: 9.2

Suggested Fix

Type: Upgrade version

Origin: GHSA-ghhp-997w-qr28

Release Date: Feb 25, 2021 11:02 PM

Fix Resolution : System.Text.Encodings.Web - 4.7.2,System.Text.Encodings.Web - 5.0.1,System.Text.Encodings.Web - 4.5.1

🔴CVE-2017-11770

Vulnerable Library - microsoft.aspnetcore.2.0.1.nupkg

Microsoft.AspNetCore

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore/2.0.1/microsoft.aspnetcore.2.0.1.nupkg

Dependency Hierarchy:

  • ❌ microsoft.aspnetcore.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".

Publish Date: Nov 15, 2017 03:00 AM

URL: CVE-2017-11770

Threat Assessment

Exploit Maturity:Not Defined

EPSS:13.0%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-7mfr-774f-w5r9

Release Date: Nov 15, 2017 03:00 AM

Fix Resolution : System.Security.Cryptography.X509Certificates - 4.1.2,Microsoft.NETCore.App - 2.0.3

🔴CVE-2018-0787

Vulnerable Library - microsoft.aspnetcore.httpoverrides.2.0.1.nupkg

ASP.NET Core basic middleware for supporting HTTP method overrides. Includes:

  • X-Forwarded-* headers to forward headers from a proxy.
  • HTTP method override header.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.httpoverrides.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.httpoverrides/2.0.1/microsoft.aspnetcore.httpoverrides.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.httpoverrides.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Publish Date: Mar 14, 2018 05:00 PM

URL: CVE-2018-0787

Threat Assessment

Exploit Maturity:Not Defined

EPSS:13.7%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-365p-96qv-xr7g

Release Date: Mar 14, 2018 05:00 PM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.0.2,Microsoft.AspNetCore.HttpOverrides - 2.0.2

🔴CVE-2018-0787

Vulnerable Library - microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Core components of ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.core/2.0.1/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

Publish Date: Mar 14, 2018 05:00 PM

URL: CVE-2018-0787

Threat Assessment

Exploit Maturity:Not Defined

EPSS:13.7%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-365p-96qv-xr7g

Release Date: Mar 14, 2018 05:00 PM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.0.2,Microsoft.AspNetCore.HttpOverrides - 2.0.2

🔴CVE-2018-0808

Vulnerable Library - microsoft.aspnetcore.hosting.2.0.1.nupkg

ASP.NET Core hosting infrastructure and startup logic for web applications.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.hosting.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.hosting/2.0.1/microsoft.aspnetcore.hosting.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.azureappservices.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.azureappservicesintegration.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.hosting.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.hosting.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.applicationinsights.hostingstartup.2.0.1.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.hosting.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.server.httpsys.2.0.1.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.hosting.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.hosting.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- dvcsharp_core_api.Program (Application)
    - Microsoft.AspNetCore.WebHost (Extension)
        - Microsoft.AspNetCore.Hosting.WebHostBuilder (Extension)
            - Microsoft.AspNetCore.Hosting.Internal.WebHost (Extension)
                - Microsoft.AspNetCore.Hosting.Internal.HostingApplication (Extension)
                    -> ❌ Microsoft.AspNetCore.Hosting.Internal.HostingApplicationDiagnostics (Vulnerable Component)

Vulnerability Details

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784.

Publish Date: Mar 14, 2018 05:00 PM

URL: CVE-2018-0808

Threat Assessment

Exploit Maturity:Not Defined

EPSS:9.9%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0808

Release Date: Mar 14, 2018 05:00 PM

Fix Resolution : Microsoft.AspNetCore.Server.IISIntegration - 2.1.0, Microsoft.AspNetCore.Hosting - 2.1.0

🔴CVE-2018-0808

Vulnerable Library - microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg

ASP.NET Core components for working with the IIS AspNetCoreModule.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.iisintegration/2.0.1/microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • ❌ microsoft.aspnetcore.server.iisintegration.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- dvcsharp_core_api.Program (Application)
    - Microsoft.AspNetCore.WebHost (Extension)
        - Microsoft.AspNetCore.Hosting.WebHostBuilderIISExtensions (Extension)
            -> ❌ Microsoft.AspNetCore.Builder.IISOptions (Vulnerable Component)

Vulnerability Details

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability". This CVE is unique from CVE-2018-0784.

Publish Date: Mar 14, 2018 05:00 PM

URL: CVE-2018-0808

Threat Assessment

Exploit Maturity:Not Defined

EPSS:9.9%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0808

Release Date: Mar 14, 2018 05:00 PM

Fix Resolution : Microsoft.AspNetCore.Server.IISIntegration - 2.1.0, Microsoft.AspNetCore.Hosting - 2.1.0

🔴CVE-2024-21907

Vulnerable Library - newtonsoft.json.11.0.2.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.11.0.2.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /opt/containerbase/tools/dotnet/sdk/NuGetFallbackFolder/newtonsoft.json/11.0.2/newtonsoft.json.11.0.2.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

    • microsoft.identitymodel.protocols.openidconnect.2.1.4.nupkg
      • microsoft.identitymodel.protocols.2.1.4.nupkg
        • system.identitymodel.tokens.jwt.5.2.2.nupkg
          • microsoft.identitymodel.tokens.5.2.2.nupkg
            • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.azureappservices.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.azureappservicesintegration.2.0.1.nupkg
      • microsoft.extensions.logging.azureappservices.2.0.0.nupkg
        • microsoft.extensions.configuration.json.2.0.0.nupkg
          • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.extensions.logging.eventsource.2.0.0.nupkg (Root Library)

    • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)

    • microsoft.extensions.configuration.json.2.0.0.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.applicationinsights.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.extensions.configuration.json.2.0.0.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

    • microsoft.identitymodel.protocols.openidconnect.2.1.4.nupkg
      • microsoft.identitymodel.protocols.2.1.4.nupkg
        • system.identitymodel.tokens.jwt.5.2.2.nupkg
          • microsoft.identitymodel.tokens.5.2.2.nupkg
            • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.dataprotection.azurestorage.2.0.1.nupkg (Root Library)

    • windowsazure.storage.8.1.4.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • system.identitymodel.tokens.jwt.5.2.2.nupkg (Root Library)

    • microsoft.identitymodel.tokens.5.2.2.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.extensions.configuration.azurekeyvault.2.0.0.nupkg (Root Library)

    • microsoft.azure.keyvault.2.3.2.nupkg
      • microsoft.rest.clientruntime.azure.3.3.7.nupkg
        • microsoft.rest.clientruntime.2.3.8.nupkg
          • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • newtonsoft.json.bson.1.0.1.nupkg
        • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.formatters.xml.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
      • microsoft.extensions.dependencymodel.2.0.3.nupkg
        • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • newtonsoft.json.bson.1.0.1.nupkg
        • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.razorpages.2.0.2.nupkg
      • microsoft.aspnetcore.mvc.razor.2.0.2.nupkg
        • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
          • newtonsoft.json.bson.1.0.1.nupkg
            • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • ❌ newtonsoft.json.11.0.2.nupkg (Vulnerable Library)

Vulnerability Details

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Publish Date: Jan 03, 2024 03:23 PM

URL: CVE-2024-21907

Threat Assessment

Exploit Maturity:Not Defined

EPSS:3.9%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: Jan 03, 2024 03:23 PM

Fix Resolution : Newtonsoft.Json - 13.0.1

🔴CVE-2020-1045

Vulnerable Library - microsoft.aspnetcore.http.2.0.1.nupkg

ASP.NET Core default HTTP feature implementations.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.http.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.http/2.0.1/microsoft.aspnetcore.http.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
        • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.identity.entityframeworkcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.identity.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.cookies.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.2.0.1.nupkg
          • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
            • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.azureappservices.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.azureappservicesintegration.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.2.0.1.nupkg
        • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • microsoft.aspnetcore.hosting.2.0.1.nupkg
        • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.facebook.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.applicationinsights.hostingstartup.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.openidconnect.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.responsecaching.2.0.1.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.spaservices.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.cookiepolicy.2.0.1.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.formatters.xml.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
      • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
        • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.owin.2.0.1.nupkg (Root Library)

    • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.google.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.microsoftaccount.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.mvc.viewfeatures.2.0.2.nupkg
      • microsoft.aspnetcore.mvc.core.2.0.2.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.server.httpsys.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.mvc.razor.viewcompilation.2.0.2.nupkg (Root Library)

    • microsoft.aspnetcore.hosting.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

  • microsoft.aspnetcore.authentication.twitter.2.0.1.nupkg (Root Library)

    • microsoft.aspnetcore.authentication.oauth.2.0.1.nupkg
      • microsoft.aspnetcore.authentication.2.0.1.nupkg
        • microsoft.aspnetcore.authentication.core.2.0.1.nupkg
          • ❌ microsoft.aspnetcore.http.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.

The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.

The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.

Publish Date: Sep 11, 2020 12:00 AM

URL: CVE-2020-1045

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:20.4%

Score: 7.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxrm-9w7p-39cc

Release Date: Sep 11, 2020 12:00 AM

Fix Resolution : Microsoft.AspNetCore.Http - 2.1.22,Microsoft.AspNetCore.App.Runtime.win-arm64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.osx-x64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.linux-arm - 3.1.8,Microsoft.AspNetCore.App - 2.1.22,Microsoft.AspNetCore.App.Runtime.win-arm - 3.1.8,Microsoft.AspNetCore.App.Runtime.linux-x64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.linux-musl-x64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.linux-arm64 - 3.1.8,Microsoft.AspNetCore.App.Runtime.win-x64 - 3.1.8,Microsoft.Owin - 4.1.1,Microsoft.AspNetCore.App.Runtime.win-x86 - 3.1.8

🔴CVE-2023-38180

Vulnerable Library - microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Libuv transport for the ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.transport.libuv/2.0.1/microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg (Vulnerable Library)

Vulnerability Details

.NET and Visual Studio Denial of Service Vulnerability

Publish Date: Aug 08, 2023 06:52 PM

URL: CVE-2023-38180

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 7.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-vmch-3w2x-vhgq

Release Date: Aug 08, 2023 06:52 PM

Fix Resolution : Microsoft.AspNetCore.App.Runtime.win-arm64 - 7.0.10,Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets - 2.1.40,Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv - 6.0.21,Microsoft.AspNetCore.App.Runtime.win-arm64 - 6.0.21,Microsoft.AspNetCore.App.Runtime.win-x64 - 6.0.21,Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv - 2.1.40,Microsoft.AspNetCore.App.Runtime.win-x86 - 6.0.21,Microsoft.AspNetCore.App.Runtime.win-x64 - 7.0.10,Microsoft.AspNetCore.App.Runtime.win-x86 - 7.0.10

🔴WS-2018-0607

Vulnerable Library - microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Core components of ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.core/2.0.1/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Denial of service vulnerability in ASP.NET Core when a malformed request is terminated.

Publish Date: Jul 10, 2018 12:00 AM

URL: WS-2018-0607

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#311

Release Date: Jul 10, 2018 12:00 AM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.2

🔴WS-2018-0608

Vulnerable Library - microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Libuv transport for the ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.transport.libuv/2.0.1/microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A vulnerability was discovered in versions 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

Publish Date: May 08, 2018 12:00 AM

URL: WS-2018-0608

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#300

Release Date: May 08, 2018 12:00 AM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv - 2.0.3,2.1.0;Microsoft.AspNetCore.All - 2.0.8,2.1.0

🔴WS-2018-0608

Vulnerable Library - microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Core components of ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.core/2.0.1/microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • ❌ microsoft.aspnetcore.server.kestrel.core.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A vulnerability was discovered in versions 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

Publish Date: May 08, 2018 12:00 AM

URL: WS-2018-0608

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#300

Release Date: May 08, 2018 12:00 AM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv - 2.0.3,2.1.0;Microsoft.AspNetCore.All - 2.0.8,2.1.0

🔴WS-2018-0608

Vulnerable Library - microsoft.aspnetcore.server.kestrel.transport.abstractions.2.0.1.nupkg

Transport abstractions for the ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.transport.abstractions.2.0.1.nupkg

Path to dependency file: /dvcsharp-core-api.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.aspnetcore.server.kestrel.transport.abstractions/2.0.1/microsoft.aspnetcore.server.kestrel.transport.abstractions.2.0.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.0.1.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.0.1.nupkg
      • microsoft.aspnetcore.server.kestrel.transport.libuv.2.0.1.nupkg
        • ❌ microsoft.aspnetcore.server.kestrel.transport.abstractions.2.0.1.nupkg (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A vulnerability was discovered in versions 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel.

Publish Date: May 08, 2018 12:00 AM

URL: WS-2018-0608

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#300

Release Date: May 08, 2018 12:00 AM

Fix Resolution : Microsoft.AspNetCore.Server.Kestrel.Core - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions - 2.0.3,2.1.0;Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv - 2.0.3,2.1.0;Microsoft.AspNetCore.All - 2.0.8,2.1.0

Activity

  1. mend-developer-platform-dev
    changed the title [-]microsoft.aspnetcore.2.0.1.nupkg: 13 vulnerabilities (highest severity is: 9.2) [master] (reachable)[/-] [+]microsoft.aspnetcore.2.0.1.nupkg: 14 vulnerabilities (highest severity is: 9.4) [master] (reachable)[/+] on Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions