Giter Club home page Giter Club logo

recordvisitors's Introduction

Record Latest visitors for .NET Core

GitHub license
BuildAndTest codecov Nuget Docs Quality Gate Status

All Contributors

What it does

This project helps you to record what visitors have you on the site. It does not enforce authentication

You can see the latest 5 minutes visitors by browsing to /recordVisitors/AllVisitors5Min or /recordVisitors/AllVisitors/5

How to use it

Simple use

In Startup,

public void ConfigureServices(IServiceCollection services)
{
    //code omitted
    services.AddRecordVisitorsDefault();
    
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    //code omitted 
    app.UseAuthentication();
    //put AFTER authentication
    app.UseRecordVisitors();
    //not necessary
    app.UseAuthorization();
    //code omitted
    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
        endpoints.UseVisitors();
    });


}

Then browse to /recordVisitors/AllVisitors5Min or /recordVisitors/AllVisitors/5

You can see also the history for the URL that the user have browsed : goto /recordVisitors/UserHistory/{userId}/{dateFrom:datetime:regex(\d{{4}}-\d{{2}}-\d{{2}})}/{dateTo?}

( to find the user id , you can also goto /recordVisitors/GetUserId/{userName})

You can see also the classes documentation at https://ignatandrei.github.io/RecordVisitors/RecordVisitors/

Customizable uses

There are several interfaces that you can implement via DI

Name Description
IRecordVisitorFunctions how to indentify the user
IRequestRecorded request of the user
IUserRecorded the user recorded interface to store data
IUsersRepository the connection to the storage( database, csv , others)

The project comes with his implementation - however, you can add yours.

Contributors ✨

Thanks goes to these wonderful people (emoji key):


Andrei Ignat
⚠️ 💻

This project follows the all-contributors specification. Contributions of any kind welcome!

Also, thanks to the people that made this possible by created frameworks and libraries - see the list here

https://github.com/ignatandrei/RecordVisitors/blob/main/src/RecordVisitors/thanks.md

Links

Licence

The code in this project is licensed under MIT license. You can find the licences for the packages used at https://github.com/ignatandrei/RecordVisitors/blob/main/src/RecordVisitors/licenses.txt

recordvisitors's People

Contributors

allcontributors[bot] avatar ignatandrei avatar mend-bolt-for-github[bot] avatar

Stargazers

avatar avatar

Watchers

avatar avatar avatar

recordvisitors's Issues

CVE-2021-26701 (High) detected in system.text.encodings.web.4.5.0.nupkg

CVE-2021-26701 - High Severity Vulnerability

Vulnerable Library - system.text.encodings.web.4.5.0.nupkg

Provides types for encoding and escaping strings for use in JavaScript, HyperText Markup Language (H...

Library home page: https://api.nuget.org/packages/system.text.encodings.web.4.5.0.nupkg

Path to dependency file: RecordVisitors/src/RecordVisitors/SampleWeb/SampleWeb.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.encodings.web/4.5.0/system.text.encodings.web.4.5.0.nupkg

Dependency Hierarchy:

  • gst.fake.authentication.jwtbearer.3.0.0.nupkg (Root Library)
    • microsoft.aspnetcore.session.2.2.0.nupkg
      • microsoft.aspnetcore.dataprotection.2.2.0.nupkg
        • microsoft.aspnetcore.hosting.abstractions.2.2.0.nupkg
          • microsoft.aspnetcore.http.abstractions.2.2.0.nupkg
            • ❌ system.text.encodings.web.4.5.0.nupkg (Vulnerable Library)

Found in HEAD commit: febe6d4a4b876b260b6c1815d146be45255d2abd

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Publish Date: 2021-02-25

URL: CVE-2021-26701

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#178

Release Date: 2021-02-25

Fix Resolution: System.Text.Encodings.Web - 4.5.1,4.7.2,5.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2017-0249 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0249 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • lightbdd.xunit2.3.3.0.nupkg (Root Library)
    • xunit.2.4.1.nupkg
      • xunit.assert.2.4.1.nupkg
        • netstandard.library.1.6.1.nupkg
          • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0249

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.3.1;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

CVE-2018-8292 (High) detected in system.net.http.4.3.0.nupkg

CVE-2018-8292 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: RecordVisitors/src/RecordVisitors/AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • xunit.2.4.1.nupkg (Root Library)
    • xunit.assert.2.4.1.nupkg
      • netstandard.library.1.6.1.nupkg
        • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3f6aa510c749db06c16ee29529fb8f8cf291eca5

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#88

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-34532 (Medium) detected in microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg

CVE-2021-34532 - Medium Severity Vulnerability

Vulnerable Library - microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg

ASP.NET Core middleware that enables an application to receive an OpenID Connect bearer token.

This...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg

Path to dependency file: /SampleWeb/SampleWeb.csproj

Path to vulnerable library: /ackages/microsoft.aspnetcore.authentication.jwtbearer/5.0.6/microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg,/home/wss-scanner/.nuget/packages/microsoft.aspnetcore.authentication.jwtbearer/5.0.6/microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg

Dependency Hierarchy:

  • ❌ microsoft.aspnetcore.authentication.jwtbearer.5.0.6.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Publish Date: 2021-08-12

URL: CVE-2021-34532

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7cg-43mg-qp69

Release Date: 2021-08-12

Fix Resolution: Microsoft.AspNetCore.Authentication.JwtBearer - 2.1.30, 3.1.18, 5.0.9

Step up your Open Source Security Game with Mend here

HTML interface

HTML 1 : Last Visitors: "/recordVisitors/AllVisitors5Min

Html2 : My Links : "/recordVisitors/MyHistory/{dateFrom:datetime:regex(\d{{4}}-\d{{2}}-\d{{2}})}/{dateTo?}

CVE-2017-0247 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0247 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • lightbdd.xunit2.3.3.0.nupkg (Root Library)
    • xunit.2.4.1.nupkg
      • xunit.assert.2.4.1.nupkg
        • netstandard.library.1.6.1.nupkg
          • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Publish Date: 2017-05-12

URL: CVE-2017-0247

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.5.4;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

CVE-2017-0248 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0248 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • lightbdd.xunit2.3.3.0.nupkg (Root Library)
    • xunit.2.4.1.nupkg
      • xunit.assert.2.4.1.nupkg
        • netstandard.library.1.6.1.nupkg
          • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Publish Date: 2017-05-12

URL: CVE-2017-0248

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1, 4.3.1;System.Net.Http - 4.1.2, 4.3.2;System.Net.Http.WinHttpHandler - 4.0.2, 4.3.1;System.Net.Security - 4.0.1, 4.3.1;System.Net.WebSockets.Client - 4.0.1, 4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4, 1.1.3

Step up your Open Source Security Game with Mend here

CVE-2022-34716 (Medium) detected in system.security.cryptography.xml.4.5.0.nupkg

CVE-2022-34716 - Medium Severity Vulnerability

Vulnerable Library - system.security.cryptography.xml.4.5.0.nupkg

Provides classes to support the creation and validation of XML digital signatures. The classes in th...

Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.4.5.0.nupkg

Path to dependency file: /SampleWeb/SampleWeb.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.security.cryptography.xml/4.5.0/system.security.cryptography.xml.4.5.0.nupkg

Dependency Hierarchy:

  • gst.fake.authentication.jwtbearer.3.0.0.nupkg (Root Library)
    • microsoft.aspnetcore.session.2.2.0.nupkg
      • microsoft.aspnetcore.dataprotection.2.2.0.nupkg
        • ❌ system.security.cryptography.xml.4.5.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

Affected software

  • Any .NET 6.0 application running on .NET 6.0.7 or earlier.
  • Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

Patches

Publish Date: 2022-08-09

URL: CVE-2022-34716

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2m65-m22p-9wjw

Release Date: 2022-08-09

Fix Resolution: Microsoft.AspNetCore.App.Runtime.linux-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-musl-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.linux-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.osx-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-arm64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x64 - 3.1.28,6.0.8;Microsoft.AspNetCore.App.Runtime.win-x86 - 3.1.28,6.0.8;System.Security.Cryptography.Xml - 4.7.1,6.0.1

Step up your Open Source Security Game with Mend here

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.3.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: RecordVisitors/src/RecordVisitors/AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • xunit.2.4.1.nupkg (Root Library)
    • xunit.assert.2.4.1.nupkg
      • netstandard.library.1.6.1.nupkg
        • system.xml.xdocument.4.3.0.nupkg
          • system.xml.readerwriter.4.3.0.nupkg
            • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3f6aa510c749db06c16ee29529fb8f8cf291eca5

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2017-0256 (Medium) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0256 - Medium Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /AutomatedTestRecord/AutomatedTestRecord.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • lightbdd.xunit2.3.3.0.nupkg (Root Library)
    • xunit.2.4.1.nupkg
      • xunit.assert.2.4.1.nupkg
        • netstandard.library.1.6.1.nupkg
          • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0256

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0256

Release Date: 2017-05-12

Fix Resolution: Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.1.3,1.0.4;System.Net.Http - 4.1.2,4.3.2;Microsoft.AspNetCore.Mvc.Razor - 1.1.3,1.0.4;System.Net.Http.WinHttpHandler - 4.0.2,4.3.0-preview1-24530-04;System.Net.Security - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;System.Text.Encodings.Web - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3;System.Net.WebSockets.Client - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.