Most recent entries from all

ALSA-2024:0150 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1.

Security Fix(es):

* dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-00281

BIT-dotnet-2024-0056 — Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Affected: Bitnami: dotnet

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

certfr-2024-avi-0022 — De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un at…

certfr-2024-avi-0022

CLEANSTART-2025-ZI95026 — Microsoft

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime

CVE-2024-0056 affects multiple packages. Microsoft. See references for individual vulnerability details.

EUVD-2026-242686

fkie_cve-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

GHSA-98g6-xh36-x2p7 — Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Affected: NuGet: Microsoft.Data.SqlClient, NuGet: System.Data.SqlClient

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

gsd-2024-0056

ICSA-24-228-02 — Siemens INTRALOG WMS

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Find more information about this vulnerability at <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056>. Impact: Decryption or modification of the communication between INTRALOG WMS SQL clients and servers. Precondition for exploitation: requires attacker to be located in the controlled network of the INTRALOG WMS deployment. .NET and Visual Studio Remote Code Execution Vulnerability Find more information about this vulnerability at <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30045>. Impact: Potential execution of arbitrary code on the INTRALOG WMS application servers. Precondition for exploitation: requires attacker to be located in the controlled network of the INTRALOG WMS deployment.

msrc_CVE-2024-0056 — Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

msrc_CVE-2024-0056

RHSA-2024:0150 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) dotnet: X509 Certificates - Validation Bypass across Azure dotnet: .NET Denial of Service Vulnerability

RHSA-2024:0255 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) dotnet: X509 Certificates - Validation Bypass across Azure dotnet: .NET Denial of Service Vulnerability

SSA-682326 — SSA-682326: Multiple Vulnerabilities in COMOS before V10.4.5

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.…

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

WID-SEC-W-2024-0037 — Microsoft SQL Server 2022: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft SQL Server 2022 bezüglich der SQL Data Provider ausnutzen, um Sicherheitsvorkehrungen zu umgehen.