Microsoft Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2.

Products

Clear product

Showing 24 vulnerabilities on this page for Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

.NET Core Remote Code Execution Vulnerability

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/432 ## CVSS Details - **Versi…

CWE-787Aug 11, 2026
CVSS7.8v3.1EPSS0.387%PoCs0SignalsSTIX

.NET Framework Elevation of Privilege Vulnerability

Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.

CWE-23Aug 11, 2026
CVSS7.8v3.1EPSS0.351%PoCs0SignalsSTIX

.NET Framework Elevation of Privilege Vulnerability

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

CWE-863Aug 11, 2026
CVSS8.8v3.1EPSS0.538%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. …

CWE-126Jan 14, 2025
CVSS8.8v3.1EPSS2.35%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

# Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 and .NET 8.0 RC2. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability. An elevation of privilege vulnerability exists in .NET where untrusted URIs provided to System.Net.Web…

CWE-20Nov 14, 2023
CVSS7.6v3.1EPSS12.5%PoCs0SignalsSTIX

ASP.NET Security Feature Bypass Vulnerability

ASP.NET Security Feature Bypass Vulnerability

Nov 14, 2023
CVSS8.8v3.1EPSS2.91%PoCs0SignalsSTIX

.NET Framework Remote Code Execution Vulnerability

.NET Framework Remote Code Execution Vulnerability

Sep 12, 2023
CVSS7.8v3.1EPSS1.21%PoCs0SignalsSTIX

Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to …

CWE-190Sep 12, 2023
CVSS7.8v3.1EPSS1.44%PoCs0SignalsSTIX

Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to …

CWE-122Sep 12, 2023
CVSS7.8v3.1EPSS1.44%PoCs0SignalsSTIX

Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to …

CWE-191Sep 12, 2023
CVSS7.8v3.1EPSS1.44%PoCs0SignalsSTIX

Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to …

CWE-191Sep 12, 2023
CVSS7.8v3.1EPSS1.44%PoCs0SignalsSTIX

ASP.NET Elevation of Privilege Vulnerability

ASP.NET Elevation of Privilege Vulnerability

CWE-20Aug 8, 2023
CVSS8.8v3.1EPSS77.1%PoCs2SignalsSTIX

.NET Framework Spoofing Vulnerability

.NET Framework Spoofing Vulnerability

CWE-20Aug 8, 2023
CVSS7.4v3.1EPSS1.5%PoCs0SignalsSTIX

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Jun 14, 2023
CVSS7.5v3.1EPSS2.22%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

# Microsoft Security Advisory CVE-2023-29331: .NET Denial of Service vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when processing X.509 certificates that may result in Denial of Service. Details: [KB5025…

CWE-400Jun 14, 2023
CVSS7.5v3.1EPSS2.63%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

# Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET when deserializing a DataSet or DataTable from XML which may result in elevation of pr…

Jun 14, 2023
CVSS7.5v3.1EPSS1.56%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-24895: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in how WPF applications load and render XPS documents which may result in remote code execution…

Jun 14, 2023
CVSS7.8v3.1EPSS1.06%PoCs0SignalsSTIX

.NET Framework Remote Code Execution Vulnerability

.NET Framework Remote Code Execution Vulnerability

Jun 14, 2023
CVSS7.8v3.1EPSS0.9%PoCs0SignalsSTIX

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

# Microsoft Security Advisory CVE-2023-24897: .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. This security update addresses a vulnerability in the MSDIA SDK where corrupted PDBs can cause heap overflow, leading …

CWE-122Jun 14, 2023
CVSS7.8v3.1EPSS1.18%PoCs0SignalsSTIX

.NET Framework Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query. ## <a name="mitigation-factors"></a>Mitigation factors If you are not talking t…

Nov 9, 2022
CVSS5.8v3.1EPSS0.747%PoCs0SignalsSTIX

.NET Framework Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability.

Apr 15, 2022
CVSS7.5v3.1EPSS3.28%PoCs0SignalsSTIX

.NET Framework Denial of Service Vulnerability

.NET Framework Denial of Service Vulnerability.

Jan 11, 2022
CVSS7.5v3.1EPSS3.05%PoCs0SignalsSTIX

.NET Framework Information Disclosure Vulnerability

An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory, aka '.NET Framework Information Disclosure Vulnerability'.

CWE-200Oct 16, 2020
CVSS4.7v3.1EPSS3.29%PoCs0SignalsSTIX

ASP.NET and .NET Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files, aka 'ASP.NET and .NET Elevation of Privilege Vulnerability'.

CWE-269Aug 17, 2020
CVSS5.5v3.1EPSS1.13%PoCs0SignalsSTIX