| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Missing authentication for critical function in Remote Desktop Client allows an unauthorized attacker to perform tampering over a network. |
| Missing authorization in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Network File System allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. |
| Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. |
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network. |
| Null pointer dereference in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network. |
| If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash. |
| Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to elevate privileges over a network. |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| Double free in Windows Shell allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. |
