vonage-dotnet-sdk
vonage-dotnet-sdk copied to clipboard
microsoft.netcore.app.2.0.0.nupkg: 2 vulnerabilities (highest severity is: 7.5)
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Vulnerabilities
CVE | Severity | CVSS | Dependency | Type | Fixed in | Remediation Available |
---|---|---|---|---|---|---|
CVE-2018-8292 | High | 7.5 | microsoft.netcore.app.2.0.0.nupkg | Direct | System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1 | ✅ |
CVE-2018-8416 | Medium | 6.5 | microsoft.netcore.app.2.0.0.nupkg | Direct | Microsoft.NETCore.App - 2.1.7 | ✅ |
Details
CVE-2018-8292
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- :x: microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
Vulnerability Details
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Publish Date: 2018-10-10
URL: CVE-2018-8292
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-10-10
Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2018-8416
Vulnerable Library - microsoft.netcore.app.2.0.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. e8b8861ac7faf042c87a5c2f9f2d04c98b69f28d When using NuGet 3.x this package requires at least version 3.4.
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.0.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.0.0/microsoft.netcore.app.2.0.0.nupkg
Dependency Hierarchy:
- :x: microsoft.netcore.app.2.0.0.nupkg (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
Vulnerability Details
A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.
Publish Date: 2018-11-14
URL: CVE-2018-8416
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2018-11-14
Fix Resolution: Microsoft.NETCore.App - 2.1.7
:rescue_worker_helmet: Automatic Remediation is available for this issue
:rescue_worker_helmet: Automatic Remediation is available for this issue.