Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
nuget vulnerabilities and exploits
(subscribe to this query)
6.8
CVSSv2
CVE-2021-24105
<p>Depending on configuration of various package managers it is possible for an malicious user to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead ...
Microsoft Package Manager Configurations -
4
CVSSv2
CVE-2021-22168
A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.
Gitlab Gitlab
5
CVSSv2
CVE-2020-12448
GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.
Gitlab Gitlab
5
CVSSv2
CVE-2020-11505
An issue exists in GitLab Community Edition (CE) and Enterprise Edition (EE) prior to 12.7.9, 12.8.x prior to 12.8.9, and 12.9.x prior to 12.9.3. A Workhorse bypass could lead to NuGet package and file disclosure (Exposure of Sensitive Information) via request smuggling.
Gitlab Gitlab
2.1
CVSSv2
CVE-2020-11005
The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a ...
Windowshello Project Windowshello
4.9
CVSSv2
CVE-2020-5261
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5....
Sustainsys Saml2
6.5
CVSSv2
CVE-2019-1258
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated malicious user to perform actions in context of another user. The authenticated atta...
Microsoft Active Directory Authentication Library 5.0.3
Microsoft Active Directory Authentication Library 5.0.2
Microsoft Active Directory Authentication Library 5.0.1
Microsoft Active Directory Authentication Library 5.0.0
Microsoft Active Directory Authentication Library
Microsoft Nuget 5.2.0
2.1
CVSSv2
CVE-2019-0976
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated malicious user to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.
Microsoft Nuget 5.0.2
1 Article
4
CVSSv2
CVE-2019-0757
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated malicious user to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.
Microsoft Visual Studio 2017 -
Microsoft Nuget 4.9.4
Microsoft Nuget 4.3.1
Microsoft Nuget 4.4.2
Microsoft Nuget 4.7.2
Microsoft Nuget 4.8.2
Microsoft Nuget 4.5.2
Microsoft Nuget 4.6.3
Mono-project Mono Framework 5.18.0.223
Mono-project Mono Framework 5.20.0
Microsoft .net Core Sdk 1.1
Microsoft .net Core Sdk 2.1.500
Microsoft .net Core Sdk 2.2.100
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
Redhat Enterprise Linux Eus 8.2
Redhat Enterprise Linux Eus 8.4
Redhat Enterprise Linux Server Aus 8.2
Redhat Enterprise Linux Server Aus 8.4
Redhat Enterprise Linux Server Tus 8.2
Redhat Enterprise Linux Server Tus 8.4
2 Articles
6.3
CVSSv2
CVE-2017-11348
In Octopus Deploy 3.x prior to 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.
Octopus Octopus Deploy 3.6.0
Octopus Octopus Deploy 3.7.0
Octopus Octopus Server 3.0.6
Octopus Octopus Server 3.0.12
Octopus Octopus Server 3.0.4
Octopus Octopus Server 3.0.18
Octopus Octopus Server 3.0.13
Octopus Octopus Server 3.0.20
Octopus Octopus Server 3.0.19
Octopus Octopus Server 3.0.26
Octopus Octopus Server 3.0.1
Octopus Octopus Server 3.0.8
Octopus Octopus Server 3.0.10
Octopus Octopus Server 3.0.15
Octopus Octopus Server 3.0.17
Octopus Octopus Server 3.0.22
Octopus Octopus Server 3.0.11
Octopus Octopus Server 3.0.14
Octopus Octopus Server 3.0.25
Octopus Octopus Server 3.0.2
Octopus Octopus Server 3.0.3
Octopus Octopus Server 3.0.5
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-33572
CVE-2024-24919
CVE-2024-0230
CVE-2024-32714
HTML injection
local file inclusion
CVE-2024-31098
CVE-2024-31244
privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2