nuget Microsoft.AspNetCore.Mvc.DataAnnotations vulnerabilities

Latest nuget Microsoft.AspNetCore.Mvc.DataAnnotations CVEs

Newest publication first

1. CVE-2017-0248 Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core

   Published 2017-05-12

   High·CVSS 7.5 EPSS 5.5%

   Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

2. CVE-2017-0249 High severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   High·CVSS 7.3 EPSS 4.2%

   An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

3. CVE-2017-0256 Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc

   Published 2017-05-12

   Medium·CVSS 5.3 EPSS 3.5%

   A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

4. CVE-2017-0247 ASP.NET Core fails to properly validate web requests

   Published 2017-05-12

   High·CVSS 7.5 EPSS 16.9%

   A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.