Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

Microsoft.NETCore.App

10 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
2.2.8 (Nov 18, 2019): no advisory affects it
Newest unaffected release
2.1.30 (Aug 19, 2021)
Advisories
10 · 1 high, 2 medium
Releases
94 since 1.0.0 (Jun 27, 2016)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

  • CVE-2021-34485
    Affects 2.1.0 to 2.1.28 (2.1.29 is outside it)
  • CVE-2021-1721
    Affects 2.1.0 to 2.1.24 (2.1.25 is outside it)
  • CVE-2020-1147
    Affects 2.1.0 to 2.1.19 (2.1.20 is outside it)
  • CVE-2020-1108
    Affects 2.1.0 to 2.1.17 (2.1.18 is outside it)
  • CVE-2019-0657
    Affects 2.1.0 to 2.1.7 (2.1.8 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
  • CVE-2019-0564
    Affects 2.1.0 to 2.1.6 (2.1.7 is outside it); 2.2.0 (2.2.1 is outside it)
  • CVE-2019-0545
    Affects 2.1.0 to 2.1.6 (2.1.7 is outside it); 2.2.0 (2.2.1 is outside it)
  • CVE-2018-8416
    Affects 2.1.0 to 2.1.6 (2.1.7 is outside it)
  • CVE-2017-11770
    Affects 1.0.0 to 2.0.0 (2.0.3 is outside it)
  • CVE-2017-8585
    Affects 1.0.0 to 1.0.5 (1.0.7 is outside it); 1.1.0 to 1.1.2 (1.1.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • CVE-2021-34485Medium 5.0

    .NET Core and Visual Studio Information Disclosure Vulnerability

    Affected: from 2.1.0, fixed in 2.1.29.

    Fixed in 2.1.29 (released Aug 10, 2021, 2 days before disclosure).

    The latest release, 2.2.8, is not affected.

  • CVE-2021-1721Medium 6.5

    .NET Core and Visual Studio Denial of Service Vulnerability

    Affected: from 2.1.0, fixed in 2.1.25.

    Fixed in 2.1.25 (released Feb 9, 2021, 16 days before disclosure).

    The latest release, 2.2.8, is not affected.

  • CVE-2020-1147High 7.8 · KEV

    A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the

    Affected: from 2.1.0, fixed in 2.1.20.

    Fixed in 2.1.20 (released Jul 14, 2020, the day of disclosure).

    The latest release, 2.2.8, is not affected.

  • .NET Core & .NET Framework Denial of Service Vulnerability

    Affected: from 2.1.0, fixed in 2.1.18.

    Fixed in 2.1.18 (released May 12, 2020, 9 days before disclosure).

    The latest release, 2.2.8, is not affected.

  • A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual…

    Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.8.

    Fixed in 2.1.8 (released Feb 12, 2019, 22 days before disclosure) and 2.2.2 (released Feb 12, 2019, 22 days before disclosure).

    The latest release, 2.2.8, is not affected.

  • A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service…

    Affected: from 2.2.0, fixed in 2.2.1; from 2.1.0, fixed in 2.1.7.

    Fixed in 2.1.7 (released Jan 8, 2019, the day of disclosure) and 2.2.1 (released Jan 8, 2019, the day of disclosure).

    The latest release, 2.2.8, is not affected.

  • An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS)…

    Affected: from 2.1.0, fixed in 2.1.7; from 2.2.0, fixed in 2.2.1.

    Fixed in 2.1.7 (released Jan 8, 2019, the day of disclosure) and 2.2.1 (released Jan 8, 2019, the day of disclosure).

    The latest release, 2.2.8, is not affected.

  • A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This…

    Affected: from 2.1.0, fixed in 2.1.7.

    Fixed in 2.1.7 (released Jan 8, 2019, 55 days after disclosure).

    The latest release, 2.2.8, is not affected.

  • .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web…

    Affected: from 1.0.0, fixed in 2.0.3.

    Fixed in 2.0.3 (released Nov 14, 2017, 1 day before disclosure).

    The latest release, 2.2.8, is not affected.

  • Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application…

    Affected: from 1.0.0, fixed in 1.0.7; from 1.1.0, fixed in 1.1.4.

    Fixed in 1.0.7 (released Sep 20, 2017, 71 days after disclosure) and 1.1.4 (released Sep 20, 2017, 71 days after disclosure).

    The latest release, 2.2.8, is not affected.