| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. |
| Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network. |
| Buffer over-read in Microsoft Windows SCSI Class System File allows an authorized attacker to disclose information locally. |
| A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way. |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds read in Storport.sys Driver allows an authorized attacker to disclose information with a physical attack. |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network. |
| Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0. |
| Use of uninitialized resource in Windows DNS allows an unauthorized attacker to execute code over an adjacent network. |
| Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network. |
| Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network. |
