NF
Product
.NET Framework
On CISA KEVExploited in the wild
207
CVEs
5
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 7High 91Medium 15Low 1
Watch
Add .NET Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-3132 | – | Jul 10 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to… Affected: 1.0; 1.1; 2.0; 3.5; 3.5.1; 4.0; +1 more |
| CVE-2013-3131 | – | Jul 10 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5, and Silverlight 5 before 5.1.20513.0, does not properly prevent changes to data in multidimensional arrays of structures,… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-1337 | – | May 15 | Microsoft .NET Framework 4.5 does not properly create policy requirements for custom Windows Communication Foundation (WCF) endpoint authentication in certain situations involving… Affected: 4.5 |
| CVE-2013-1336 | – | May 15 | The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allows remote attackers to make undetected… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-0073 | – | Feb 13 | The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during… Affected: 3.5; 3.5.1; 4.0; 4.5; 2.0 |
| CVE-2013-0005 | – | Jan 9 | The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on… Affected: 3.5; 3.5; 3.5.1; 4.0 |
| CVE-2013-0004 | – | Jan 9 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers… Affected: 1.0; 1.1; 2.0; 4.0; 3.5; 3.5.1; +1 more |
| CVE-2013-0003 | – | Jan 9 | Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to… Affected: 2.0; 4.0; 3.5; 3.5.1; 4.5 |
| CVE-2013-0002 | – | Jan 9 | Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to… Affected: 1.0; 1.1; 2.0; 4.0; 3.5; 3.5.1; +1 more |
| CVE-2013-0001 | – | Jan 9 | The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows… Affected: 1.0; 1.1; 2.0; 4.0; 3.5; 3.5.1; +1 more |
| CVE-2012-4777 | – | Nov 14 | The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to… Affected: 4.0; 4.5 |
| CVE-2012-4776 | – | Nov 14 | The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during… Affected: 2.0; 3.5.1; 4.0; 3.5; 4.5 |
| CVE-2012-2519 | – | Nov 14 | Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, and 4 allows local users to gain privileges… Affected: 1.0; 1.1; 2.0; 3.5.1; 4.0; 3.5 |
| CVE-2012-1896 | – | Nov 14 | Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive… Affected: 2.0; 3.5.1 |
| CVE-2012-1895 | – | Nov 14 | The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissions, which allows remote attackers to… Affected: 1.0; 1.1; 2.0; 3.5.1; 4.0 |
| CVE-2012-1855 | – | Jun 12 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML… Affected: 2.0; 3.5.1; 4.0 |
| CVE-2012-0164 | – | May 9 | Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to cause a denial of service (application hang) via crafted requests to a Windows… Affected: 4.0 |
| CVE-2012-0162 | – | May 9 | Microsoft .NET Framework 4 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2)… Affected: 4.0 |
| CVE-2012-0161 | – | May 9 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly handle an unspecified exception during use of partially trusted assemblies to… Affected: 1.0; 1.1; 2.0; 3.0; 3.5; 3.5.1; +1 more |
| CVE-2012-0160 | – | May 9 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly serialize input data, which allows remote attackers to execute arbitrary code… Affected: 1.0; 1.1; 2.0; 3.0; 3.5; 3.5.1; +1 more |
| CVE-2012-0163 | – | Apr 10 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code… Affected: 1.0; 1.1; 2.0; 3.5; 3.5.1; 4.0; +1 more |
| CVE-2012-0015 | – | Feb 14 | Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a… Affected: 2.0; 3.5.1 |
| CVE-2011-1253 | – | Oct 12 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance, which allows remote attackers to… Affected: 1.0; 1.1; 2.0; 3.5.1; 4.0 |
| CVE-2011-1978 | – | Aug 10 | Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4 does not properly validate the System.Net.Sockets trust level, which allows remote attackers to obtain sensitive information or… Affected: 4.0; 3.5.1; 2.0 |
| CVE-2011-1977 | – | Aug 10 | The ASP.NET Chart controls in Microsoft .NET Framework 4, and Chart Control for Microsoft .NET Framework 3.5 SP1, do not properly verify functions in URIs, which allows remote… Affected: 4.0 |
| CVE-2011-0664 | – | Jun 16 | Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking… Affected: 4.0; 3.5.1; 2.0; 3.5; 2.0; 3.5 |
| CVE-2010-3958 | – | Apr 13 | The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows remote attackers to execute arbitrary code… Affected: 4.0; 3.5.1; 2.0; 3.5 |
| CVE-2010-3228 | – | Oct 13 | The JIT compiler in Microsoft .NET Framework 4.0 on 64-bit platforms does not properly perform optimizations, which allows remote attackers to execute arbitrary code via a crafted… Affected: 4.0 |
| CVE-2010-3332 | – | Sep 22 | Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error… Affected: 1.1; 2.0; 2.0; 3.5; 3.5; 3.5.1; +1 more |
| CVE-2010-1898 | – | Aug 11 | The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP1, 2.0 SP2, 3.5, 3.5 SP1, and 3.5.1, and Microsoft Silverlight 2 and 3 before 3.0.50611.0 on Windows and before… Affected: 2.0; 2.0; 3.5; 3.5; 3.5.1 |
| CVE-2010-2085 | – | May 27 | The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site… Affected: through 1.0; 1.0; 1.0; 1.0; 1.0; 1.0 |
| CVE-2009-3126 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2528 | – | Oct 14 | GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2504 | – | Oct 14 | Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2503 | – | Oct 14 | GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2501 | – | Oct 14 | Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2500 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: 1.1; 2.0; 2.0 |
| CVE-2009-2497 | – | Oct 14 | The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote… Affected: 2.0; 2.0; 1.1; 2.0; 2.0; 3.5; +14 more |
| CVE-2009-0091 | – | Oct 14 | Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute… Affected: 1.1; 2.0; 2.0; 1.1; 2.0; 2.0; +15 more |
| CVE-2009-0090 | – | Oct 14 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory,… Affected: 1.1; 2.0; 2.0; 1.1; 2.0; 2.0; +15 more |
| CVE-2009-1536 | – | Aug 12 | ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which… Affected: 2.0; 2.0; 3.5; 3.5 |
| CVE-2008-5100 | – | Nov 17 | The strong name (SN) implementation in Microsoft .NET Framework 2.0.50727 relies on the digital signature Public Key Token embedded in the pathname of a DLL file instead of the… Affected: 2.0.50727 |
| CVE-2008-3843 | – | Aug 27 | Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows… Affected: 1.0; 1.1; 2.0 |
| CVE-2008-3842 | – | Aug 27 | Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which… Affected: 2.0; 1.1; 1.0 |
| CVE-2007-0043 | – | Jul 10 | The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute… Affected: 1.0; 1.1; 2.0 |
| CVE-2007-0042 | – | Jul 10 | Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files… Affected: 1.0; 1.1; 2.0 |
| CVE-2007-0041 | – | Jul 10 | The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified… Affected: 1.0; 1.1; 2.0 |
| CVE-2006-7192 | – | Apr 10 | Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site… Affected: 2.0 |
| CVE-2006-3436 | – | Oct 10 | Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "ASP.NET… Affected: 2.0 |
| CVE-2006-1300 | – | Jul 11 | Microsoft .NET framework 2.0 (ASP.NET) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1 allows remote attackers to bypass access restrictions via… Affected: 2.0 |