| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition.
The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue. |
| Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| Improper input validation in Windows Message Queuing allows an authorized attacker to deny service over a network. |
| Time-of-check time-of-use (toctou) race condition in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
| Untrusted search path in Windows Remote Access API allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally. |
| Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network. |
| The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
