IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.8Yüksek

CVE-2026-114148ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux Yayım: (14 gün önce)

Açıklama

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Zayıflık türü (CWE): CWE-276

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
microsoft asp net core runtime and targeting-pack linux tarballs microsoft published 8.0.0 – < 9.0.22
Microsoft ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) 8.0.0 – < 9.0.22
Microsoft .NET 10.0 installed on Linux 10.0.0 – < 10.0.403
Microsoft .NET 10.0 installed on Mac OS 10.0.0 – < 10.0.403
Microsoft .NET 10.0 installed on Windows 10.0.0 – < 10.0.403
Microsoft .NET 11.0 installed on Linux 11.0.0-preview.1 – < 11.0.100-rc.3
Microsoft .NET 11.0 installed on Mac OS 11.0.0-preview.1 – < 11.0.100-rc.3
Microsoft .NET 11.0 installed on Windows 11.0.0-preview.1 – < 11.0.100-rc.3
Microsoft .NET 8.0 installed on Linux 8.0.0 – < 8.0.427
Microsoft .NET 8.0 installed on Mac OS 8.0.0 – < 8.0.427
Microsoft .NET 8.0 installed on Windows 8.0.0 – < 8.0.427
Microsoft .NET 9.0 installed on Linux 9.0.0 – < 9.0.320
Microsoft .NET 9.0 installed on Mac OS 9.0.0 – < 9.0.320
Microsoft .NET 9.0 installed on Windows 9.0.0 – < 9.0.320
Microsoft .NET source-build Linux tarballs (all archive types) 8.0.100 – < 10.0.403-servicing.26523.112

Ubuntu düzeltmeleri

  • USN-8958-1 .NET vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 29.10.2026 · dotnet10, dotnet11, dotnet8

Kaynaklar ve yamalar

Aynı üründe son açıklar — Ubuntu 22.04 LTS

7.7Yüksek
CVE-2026-109518

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

Puansız
CVE-2026-99095

drm/vc4: drain the hangcheck timer and works on V3D unbind

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown…