Alejandro Pacheco

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

An issue exists where the system does not fail securely, known as failing open. This allows an unauthorized attacker to bypass a security feature, specifically Extended Protection, over a network.

Allocation of resources without limits or throttling allows an unauthorized attacker to cause a denial of service over a network. Specifically, Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, which can lead to remote process memory exhaustion.

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to cause a denial of service over a network. Specifically, Minimal API validation repeatedly copies a growing validation-error dictionary, which enables attacker-controlled collections to trigger quadratic CPU work after the client disconnects.

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to cause a denial of service over a network.