Adam Kistler

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.

Allocation of resources without limits or throttling allows an unauthorized attacker to cause a denial of service over a network. Specifically, Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, which can lead to remote process memory exhaustion.

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.