Weeraphat Srisutham

Improper access control in .NET allows an authorized attacker to elevate privileges locally.

A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. SignalR connections are not consistently bound to the identity negotiated at connection establishment, which enables injected messages to execute Hub invocations as the victim.

Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network. This issue can be exploited remotely without requiring authentication.

Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

A permissions issue exists where a malicious application may be able to bypass Privacy preferences.