CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

Shibboleth 代码问题漏洞

Shibboleth is an open source SAML protocol Web Single Sign-On system for Windows from Shibboleth, UK. A security vulnerability exists in Shibboleth Service Provider SP Windows versions prior to 3.4.1, which stems from the installation being located under C:opt instead of C:Program Files by defaul...

CVE-2023-21681

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

CVE-2023-21681

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

Remote code execution

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

Microsoft OLE DB Provider for SQL Server 安全漏洞

Microsoft OLE DB Provider for SQL Server is an API from Microsoft Corporation that allows access to data from a variety of sources in a unified way. A security vulnerability exists in Microsoft OLE DB Provider for SQL Server. An attacker exploiting this vulnerability could remotely execute code...

KB5022282: Windows 10 Version 20H2 / Windows 10 Version 21H2 / Windows 10 Version 22H2 Security Update (January 2023)

The remote Windows host is missing security update 5022282. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2023-21732 - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-21681 - Window...

PT-2023-1258 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft WDAC OLE DB provider for SQL Server affected versions not specified Description: The issue is related to insufficient input validation in the Microsoft WDAC OLE DB provider for SQL Server component in Windows operating systems. This...

KB5022343: Windows Server 2012 Security Update (January 2023)

The remote Windows host is missing security update 5022343. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2023-21732 - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-21681 -...

KLA20158 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information. Below is a complete list of...

KB5022287: Windows 11 Security Update (January 2023)

The remote Windows host is missing security update 5022287. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2023-21732 - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-21681 - Window...

KB5022291: Windows Server 2022 Security Update (January 2023)

The remote Windows host is missing security update 5022291. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2023-21732 - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-21681 - Window...

PT-2023-1279

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.5.1 Apache Airflow MySQL Provider versions prior to 4.0.0 Description The issue is related to the improper neutralization of special elements used in a command, which can lead to command injection. This can...

PT-2023-10099 · Unknown · Ttskch Paginationserviceprovider

Name of the Vulnerable Software and Affected Versions: ttskch PaginationServiceProvider versions up to 0.x Description: A critical vulnerability was found in the ttskch PaginationServiceProvider. The issue affects the file demo/index.php of the component demo. The manipulation of the sort/id...

部分Dell产品 操作系统命令注入漏洞

Dell EMC Unisphere for PowerMax is a suite of graphical management tools for PowerMax storage arrays from Dell USA. A security vulnerability exists in Dell EMC Unisphere for PowerMax vApp, VASA Provider vApp, and Solutions Enabler vApp version 9.2.3.x, which stems from the inclusion of incorrect...

CVE-2022-32638

In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494449; Issue ID: ALPS07494449...

SAP NetWeaver AS Java XSS (3262544)

Due to insufficient input validation, SAP NetWeaver AS Java HTTP Provider Service - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality...

SimpleSAMLphp 跨站脚本漏洞

SimpleSAMLphp is a PHP authentication application that implements SAML 2.0 service provider and identity provider functionality. A cross-site scripting vulnerability exists in SimpleSAMLphp that stems from cross-site scripting due to misuse of the parameter AuthState...

CVE-2022-46172

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable...