| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally. |
| Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network. |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network. |
| Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
| Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network. |
| Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally. |
| Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally. |
| Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0. |
| Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network. |
| Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. |
| Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network. |
