| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. |
| Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. |
| Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. |
| Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network. |
| Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally. |
| The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process. |
| On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes. |
| A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
| Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally. |
| Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
