*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.
An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2019-0548
### Vulnerable Libraries - microsoft.netcore.dotnethostresolver.2.2.0.nupkg, microsoft.netcore.dotnetapphost.2.2.0.nupkg, microsoft.netcore.dotnethostpolicy.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnethostresolver/2.2.0/microsoft.netcore.dotnethostresolver.2.2.0.nupkg
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.
A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - microsoft.netcore.app.2.2.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2019-1302
### Vulnerable Library - microsoft.netcore.app.2.2.0.nupkgA set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg
Dependency Hierarchy: - :x: **microsoft.netcore.app.2.2.0.nupkg** (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
### Vulnerability DetailsAn elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.
Publish Date: 2019-09-11
URL: CVE-2019-1302
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2019-09-11
Fix Resolution: Microsoft.AspNetCore.SpaServices - 2.2.1,2.1.2
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2019-0545
### Vulnerable Library - microsoft.netcore.app.2.2.0.nupkgA set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg
Dependency Hierarchy: - :x: **microsoft.netcore.app.2.2.0.nupkg** (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
### Vulnerability DetailsAn information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
Publish Date: 2019-01-08
URL: CVE-2019-0545
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2019-01-14
Fix Resolution: Microsoft.NETCore.App - 2.1.7,2.2.1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2019-0548
### Vulnerable Libraries - microsoft.netcore.dotnethostresolver.2.2.0.nupkg, microsoft.netcore.dotnetapphost.2.2.0.nupkg, microsoft.netcore.dotnethostpolicy.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg### microsoft.netcore.dotnethostresolver.2.2.0.nupkg
Provides an implementation of framework resolution strategy used by Microsoft.NETCore.DotNetHost 12...
Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostresolver.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnethostresolver/2.2.0/microsoft.netcore.dotnethostresolver.2.2.0.nupkg
Dependency Hierarchy: - microsoft.netcore.app.2.2.0.nupkg (Root Library) - microsoft.netcore.dotnethostpolicy.2.2.0.nupkg - :x: **microsoft.netcore.dotnethostresolver.2.2.0.nupkg** (Vulnerable Library) ### microsoft.netcore.dotnetapphost.2.2.0.nupkg
Provides the .NET Core app bootstrapper intended for use in the application directory 1249f08feda72...
Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnetapphost.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnetapphost/2.2.0/microsoft.netcore.dotnetapphost.2.2.0.nupkg
Dependency Hierarchy: - microsoft.netcore.app.2.2.0.nupkg (Root Library) - microsoft.netcore.dotnethostpolicy.2.2.0.nupkg - microsoft.netcore.dotnethostresolver.2.2.0.nupkg - :x: **microsoft.netcore.dotnetapphost.2.2.0.nupkg** (Vulnerable Library) ### microsoft.netcore.dotnethostpolicy.2.2.0.nupkg
Provides a CoreCLR hosting policy implementation -- configuration settings, assembly paths and assem...
Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostpolicy.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.netcore.dotnethostpolicy/2.2.0/microsoft.netcore.dotnethostpolicy.2.2.0.nupkg
Dependency Hierarchy: - microsoft.netcore.app.2.2.0.nupkg (Root Library) - :x: **microsoft.netcore.dotnethostpolicy.2.2.0.nupkg** (Vulnerable Library) ### microsoft.netcore.app.2.2.0.nupkg
A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg
Dependency Hierarchy: - :x: **microsoft.netcore.app.2.2.0.nupkg** (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
### Vulnerability DetailsA denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.
Publish Date: 2019-01-08
URL: CVE-2019-0548
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2019-01-08
Fix Resolution: Microsoft.AspNetCore.SignalR - 1.1.0; Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets - 2.2.1; Microsoft.AspNetCore.Server.IIS - 2.2.1; Microsoft.AspNetCore.Server.IISIntegration - 2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2019-0564
### Vulnerable Library - microsoft.netcore.app.2.2.0.nupkgA set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...
Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg
Path to dependency file: /Vonage.Test.Unit/Vonage.Test.Unit.csproj
Path to vulnerable library: /ages/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg
Dependency Hierarchy: - :x: **microsoft.netcore.app.2.2.0.nupkg** (Vulnerable Library)
Found in HEAD commit: 4189dab236817de8afdf73098cc8842b3cb25908
Found in base branch: main
### Vulnerability DetailsA denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
Publish Date: 2019-01-08
URL: CVE-2019-0564
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2019-01-08
Fix Resolution: Microsoft.AspNetCore.WebSockets - 2.1.7,2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7;System.Net.WebSockets.WebSocketProtocol - 4.5.3;Microsoft.NETCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.All - 2.1.7,2.2.1
:rescue_worker_helmet: Automatic Remediation is available for this issue:rescue_worker_helmet: Automatic Remediation is available for this issue.