Jacob Keith

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. SignalR connections are not consistently bound to the identity negotiated at connection establishment, which enables injected messages to execute Hub invocations as the victim.

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.