I don't think it provides any significant security risks, it's patched for holes like everything else is.
I think Locutus made a good point about the security around it, and it was actually something that I was a bit curious about. There tends to be a lot of assumptions when it comes to vulnerabilities, and people tend to find them to be far worse than they are.
I mean... a C# application can't exploit a vulnerability in .NET unless you run it. So, there's always the "human wall of protection" to avoid any problems. However, when you run into issues such as SQL injection vulnerabilities or Flash vulnerabilities, most of these can be a bit more serious. Flash tends to run as long as someone embeds a SWF on a website, and all it takes is some Google Fu to find out how to actually work a SQL injection as long as you know a site is vulnerable.
I've toyed around with some content management systems (CMS) in the past for kicks, and it's not unheard of to have to patch them to fix SQL injections. The worst part is that if you don't patch them, the "hackers" know the injection point exists, because the CMS developer has published the fix!
So, after that bit of a tale of horror, what I'm trying to get at is in regard to .NET-based applications, chances are you're absolutely safe.
