Ludvig Pedersen

**Name of the Vulnerable Software and Affected Versions** System.Security.Cryptography.Xml versions 10.0.0 through 10.0.5 System.Security.Cryptography.Xml versions 9.0.0 through 9.0.14 System.Security.Cryptography.Xml versions 8.0.0 through 8.0.2 **Description** Uncontrolled resource consumption in the `EncryptedXml` class allows an unauthorized attacker to perform a Denial of Service attack over a network. **Recommendations** Update System.Security.Cryptography.Xml versions 10.0.0 through 10.0.5 to version 10.0.6. Update System.Security.Cryptography.Xml versions 9.0.0 through 9.0.14 to version 9.0.15. Update System.Security.Cryptography.Xml versions 8.0.0 through 8.0.2 to version 8.0.3.

**Name of the Vulnerable Software and Affected Versions** .NET versions 8.0.0 through 8.0.25 .NET versions 9.0.0 through 9.0.14 .NET versions 10.0.0 through 10.0.5 **Description** Improper neutralization of special elements in System.Net.Mail allows an unauthorized attacker to perform a spoofing attack over a network by using specially crafted data. **Recommendations** Update .NET 8.0 to version 8.0.26. Update .NET 9.0 to version 9.0.15. Update .NET 10.0 to version 10.0.6.

**Name of the Vulnerable Software and Affected Versions** .NET (affected versions not specified) Visual Studio (affected versions not specified) **Description** A stack-based buffer overflow allows an unauthorized attacker to cause a denial of service over a network. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** System.Security.Cryptography.Xml versions 10.0.0 through 10.0.5 System.Security.Cryptography.Xml versions 9.0.0 through 9.0.14 System.Security.Cryptography.Xml versions 8.0.0 through 8.0.2 .NET (affected versions not specified) .NET Framework (affected versions not specified) Visual Studio (affected versions not specified) **Description** An issue exists in the `EncryptedXml` class where an unauthorized attacker can cause an infinite loop, which is a loop with an unreachable exit condition. This can be exploited over a network to perform a Denial of Service attack, causing the system to become unavailable. **Recommendations** Update System.Security.Cryptography.Xml versions 10.0.0 through 10.0.5 to version 10.0.6. Update System.Security.Cryptography.Xml versions 9.0.0 through 9.0.14 to version 9.0.15. Update System.Security.Cryptography.Xml versions 8.0.0 through 8.0.2 to version 8.0.3.

**Name of the Vulnerable Software and Affected Versions** Azure DevOps Server (affected versions not specified) **Description** A server-side request forgery (SSRF) condition exists in Azure DevOps Server. Successful exploitation allows an authorized attacker to perform spoofing attacks over a network due to insufficient server-side request validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.