Microsoft Net Framework vulnerabilities

CVE-2012-2519 [HIGH] CVE-2012-2519: Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 S Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .NET application, aka ".NET Framework Insecure Library Loading Vulnerability."

CVE-2019-0657 [MEDIUM] CWE-20 CVE-2019-0657: A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

CVE-2025-55248 [MEDIUM] CWE-326 CVE-2025-55248: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

CVE-2006-3436 [MEDIUM] CVE-2006-3436: Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET controls that set the AutoPostBack property to true".

CVE-2015-1672 [MEDIUM] CWE-310 CVE-2015-1672: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to ca Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."

CVE-2008-3843 [MEDIUM] CWE-79 CVE-2008-3843: Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STY

CVE-2012-0164 [MEDIUM] CVE-2012-0164: Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to cause a denial of service (application hang) via crafted requests to a Windows Presentation Foundation (WPF) application, aka ".NET Framework Index Comparison Vulnerability."

CVE-2020-1476 [MEDIUM] CVE-2020-1476: An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update

CVE-2002-0409 [MEDIUM] CVE-2002-0409: orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated o orderdetails.aspx, as made available to Microsoft .NET developers as example code and demonstrated on www.ibuyspystore.com, allows remote attackers to view the orders of other users by modifying the OrderID parameter.

CVE-2013-0001 [MEDIUM] CWE-200 CVE-2013-0001: The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3. The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unma

CVE-2015-6115 [MEDIUM] CWE-200 CVE-2015-6115: Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protecti Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass."

CVE-2015-1648 [LOW] CWE-19 CVE-2015-1648: ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."

CVE-2015-1670 [MEDIUM] CWE-200 CVE-2015-1670: The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."

CVE-2008-3842 [MEDIUM] CWE-79 CVE-2008-3842: Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "</" (less-than slash) sequence.

CVE-2014-4062 [MEDIUM] CWE-264 CVE-2014-4062: Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the A Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive address information via a crafted web site, aka ".NET ASLR Vulnerability."

CVE-2014-4122 [MEDIUM] CWE-264 CVE-2014-4122: Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows r Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows remote attackers to obtain potentially sensitive information about memory addresses by leveraging the predictability of an executable image's location, aka ".NET ASLR Vulnerability."

CVE-2020-16937 [MEDIUM] CVE-2020-16937: <p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory. To exploit the vulnerability, an authenticated attacker would need to run a specially crafted application. The update addresses the vulne

CVE-2019-1142 [MEDIUM] CWE-22 CVE-2019-1142: An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'.

CVE-2006-7192 [MEDIUM] CVE-2006-7192: Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site scripting (XSS) attacks, or cause a denial of service, as demonstrated via an xss:expression STYLE attribute in a closing XSS HTML tag.

CVE-2022-41064 [MEDIUM] CVE-2022-41064: .NET Framework Information Disclosure Vulnerability .NET Framework Information Disclosure Vulnerability