system.text.encodings.web (microsoft) — Vulnerabilities

Signals

Monitoring NVD, CISA KEV, EPSS and the Dragons Community ransomware tracker in near-real timeMonitoring NVD, CISA KEV, EPSS and the Dragons Community ransomware tracker in near-real time

Vendors · microsoft · system.text.encodings.web

system.text.encodings.web

· 3 CVEsmicrosoft · 3 known vulnerabilities

Total

Critical

High

Medium

CISA KEV

CVE-2017-0256

May 12, 2017

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

CVE-2017-0249

May 12, 2017

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

CVE-2017-0247

May 12, 2017

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

All microsoft products All Vendors CVE Database KEV Catalog