Microsoft asp.net model view controller vulnerabilities

Latest Microsoft asp.net model view controller CVEs

Newest publication first

1. CVE-2018-8171 Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated

   Published 2018-07-11

   High·CVSS 7.5 EPSS 10.8%

   A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

2. CVE-2017-0249 High severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   High·CVSS 7.3 EPSS 4.2%

   An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

3. CVE-2017-0256 Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   Medium·CVSS 5.3 EPSS 3.5%

   A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

4. CVE-2017-0247 ASP.NET Core fails to properly validate web requests

   Published 2017-05-12

   High·CVSS 7.5 EPSS 16.9%

   A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc...

5. CVE-2014-4075 Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a cra...

   Published 2014-10-15

   Medium·CVSS 4.3 EPSS 20.2%

   Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability."

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.