CVE-2016-0033 — Code Injection in Microsoft NET Framework

CWE-94 — Code Injection3 documents3 sources
Severity
7.5HIGHNVD
EPSS
23.4%
top 4.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET Framework
Timeline
PublishedFeb 10
Latest updateMay 14

Description

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of Service Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDmicrosoft/net_framework6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-gr9c-h5pv-hgrp: Microsoft↗2022-05-14
▶
CVEList
CVE-2016-0033: Microsoft↗2016-02-10
▶
CVE-2016-0033 — Code Injection in Microsoft | cvebase