Security Feed

Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.

Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.

Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.