Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly development-server debug page can reflect unencoded exception text, allowing cross-origin script injection through the unauthenticated /framework/debug endpoint used by dotnet watch. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/478 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.3.26522.14810.0.14· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C source. Certain values originating in the application being debugged, including `ToString()` results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer's machine when the developer evaluates an expression during debugging. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/445 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 -…
Recommended action: Upgrade to 11.0.0-rc.3.26522.148 (pre-release) or 10.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.