| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. |
| nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can provide an arbitrary HOME path with length that is truncated to 0. The expression (homelen - 1) is promoted to signed int and becomes -1 and producing an out-of-bounds read and an out-of-bounds write one byte before the path buffer.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable. |
| Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| Windows DNS Information Disclosure Vulnerability |
| Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release. |
| NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, information disclosure, or data tampering. |
