28540 matches found
Microsoft Planetary Computer Pro Information Disclosure Vulnerability
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network...
Microsoft Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...
Azure Virtual Network Gateway Remote Code Execution Vulnerability
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network...
Microsoft Power Pages Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Microsoft Power Pages allows an unauthorized attacker to execute code over a network...
Azure Stack HCI Information Disclosure Vulnerability
Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network...
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Azure Privileged Identity Management PIM allows an authorized attacker to elevate privileges over a network...
Azure Resource Manager Elevation of Privilege Vulnerability
Improper authentication in Azure Resource Manager ARM allows an unauthorized attacker to elevate privileges over a network...
gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
...
Unbounded name compression in certain cases causes degradation of service
...
Heap overflow with multiple NSID, COOKIE, PADDING EDNS options
...
Degradation of service with unbounded NSEC3 hash calculations
...
Another 'ghost domain names' attack variant
...
Jostle logic bypass degrades resolution performance
...
Long list of incoming EDNS options degrades performance
...
Possible arbitrary code execution during DNSSEC validation
...
Use after free and crash under special conditions in RPZ code
...
Crash during DNSSEC validation of malicious content
...
Possible cache poisoning via promiscuous records for the authority section
...
Packet of death with DNSCrypt
...
Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
...
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
...
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
...
Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy
...
Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
...
Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()
...
Rsync < 3.4.3 Integer Overflow Information Disclosure
...
Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
...
net: qrtr: ns: Limit the maximum server registration per node
...
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
...
Microsoft Defender Denial of Service Vulnerability
...
Microsoft Defender Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network...
Windows BitLocker Security Feature Bypass Vulnerability
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be...
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
Microsoft Defender Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Microsoft Defender allows an authorized attacker to elevate privileges locally...
GNU Binutils objdump bucomm.c display_info memory leak
...
Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network...
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
...
Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
...
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
...
etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks
...
Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
...
ptrace: slightly saner 'get_dumpable()' logic
...
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
...
NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
...
NGINX ngx_http_rewrite_module vulnerability
...
NGINX ngx_http_charset_module vulnerability
...
NGINX ngx_http_ssl_module vulnerability
...