6035 matches found
CVE-2026-20842 Microsoft DWM Core Library Elevation of Privilege Vulnerability
...
CVE-2026-20805
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally...
CVE-2026-20805
CVE-2026-20805 is a local information-disclosure vulnerability in Microsoft Windows Desktop Window Manager (dwm.exe). The provided documents describe that an authenticated, low-privilege user can leak sensitive information via improper handling of ALPC-related structures (ALPC ports/sections) and...
CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability
...
CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability
...
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally...
Desktop Window Manager Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally...
Astra Linux – Vulnerability in xwayland, xorg-server
A flaw was discovered in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can result in dangling pointers, leading to a use-after-free condition. This can cause memory corruption or a system crash, potentiall...
Microsoft Desktop Windows Manager 安全漏洞
Microsoft Desktop Windows Manager is a desktop window manager from Microsoft Corporation USA. A security vulnerability exists in Microsoft Desktop Windows Manager. An attacker exploiting this vulnerability could gain access to sensitive information. The following products and versions are...
Microsoft Windows Desktop Window Manager Use-After-Free Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the desktop window...
VulnCheck KEV: CVE-2026-20805
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally...
PT-2026-2716
Name of the Vulnerable Software and Affected Versions Microsoft Windows versions affected versions not specified Description A use-after-free condition exists in the Desktop Windows Manager that could allow an authorized attacker to gain elevated privileges on a local system. Recommendations At t...
MiracleLinux 7 : xorg-x11-server-1.20.4-99.0.6.el7.AXS7 (AXSA:2025-10912:05)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10912:05 advisory. CVE-2025-49178: fix request handling flaw causing potential denial of service CVEs: CVE-2025-49178 A flaw was found in the X server's request...
CVE-2021-33326
Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...
CVE-2021-28307
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon...
CVE-2021-28133
Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participan...
CVE-2021-0438
In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAGOBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...
CVE-2021-0339
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app is brought to the foreground. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Produc...
CVE-2022-0212
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...