| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. |
| Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. |
| Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
| Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally. |
| Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. |
| Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network. |
| Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered. |
| A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure. |
| A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure. |
| In the Linux kernel, the following vulnerability has been resolved:
nvmet: use the local P2P device on metadata allocation failure
nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.
Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation. |
| Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized attacker to execute code over a network. |
| External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. |
