An update of the dotnet package has been released.

Multiple vulnerabilities exist in ASP.NET Core 6.0 < 6.0.20 and ASP.NET Core 7.0 < 7.0.9.

  - A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve   cross-session/cross-user elevation of privilege (EoP) and code execution. (CVE-2023-33127)

  - A vulnerability exists in ASP.NET Core applications where account lockout maximum failed attempts may not   be immediately updated, allowing an attacker to try more passwords. (CVE-2023-33170)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may     not be immediately updated, allowing an attacker to try more passwords. (CVE-2023-33170)

  - A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve     cross-session/cross-user elevation of privilege (EoP) and code execution. (CVE-2023-33127)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_Jul_11 advisory.

  - .NET and Visual Studio Elevation of Privilege Vulnerability (CVE-2023-33127)

  - ASP.NET and Visual Studio Security Feature Bypass Vulnerability (CVE-2023-33170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2023_July_11 advisory.

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. (CVE-2023-33127)   
  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application. (CVE-2023-33170)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
237067	Photon OS 4.0: Dotnet PHSA-2025-4.0-0804	Nessus	PhotonOS Local Security Checks	5/22/2025	6/13/2025	high
178206	Security Updates for Microsoft ASP.NET Core (July 2023)	Nessus	Windows : Microsoft Bulletins	7/12/2023	1/1/2025	high
178161	Security Updates for Microsoft Visual Studio Products (July 2023)	Nessus	Windows : Microsoft Bulletins	7/11/2023	1/1/2025	high
178193	Security Update for Microsoft .NET Core (July 2023)	Nessus	Windows	7/12/2023	1/1/2025	high
178297	Security Update for .NET Core SDK (July 2023)	Nessus	Windows	7/14/2023	1/1/2025	high
234310	Photon OS 5.0: Dotnet PHSA-2025-5.0-0499	Nessus	PhotonOS Local Security Checks	4/13/2025	4/14/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical