CVE Vulnerability Catalog

Windows SmartScreen Security Feature Bypass Vulnerability. Technical details are not provided in the description.

Windows MSHTML Platform Elevation of Privilege Vulnerability. Technical details are not provided in the description.

Wykryto podatność w kontrolerze stref przechowywania ShareFile zarządzanym przez klienta, która, jeśli zostanie wykorzystana, może umożliwić nieautoryzowanemu atakującemu zdalne przejęcie kontroli nad tym kontrolerem.

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

An integer overflow was addressed with improved input validation. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.

A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.

Zidentyfikowano podatność Cross-Site Request Forgery (CSRF) w PaperCut NG/MF, która w określonych warunkach może umożliwić atakującemu zmianę ustawień zabezpieczeń lub wykonanie dowolnego kodu. Wykorzystanie tej podatności jest możliwe, gdy celem jest administrator z aktywną sesją logowania.

Pre-authentication command injection vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 prior to V5.21(AATB.11)C0, and NAS542 prior to V5.21(ABAG.11)C0. An unauthenticated attacker could execute OS commands remotely by sending a crafted HTTP request.

Microsoft Streaming Service Elevation of Privilege Vulnerability.

Elevation of Privilege vulnerability in Microsoft SharePoint Server. Technical details are not provided in the description.

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

Heap-based buffer overflow in SSL-VPN in FortiOS and FortiProxy, allowing a remote attacker to execute arbitrary code or commands via specially crafted requests.

Command injection vulnerability in VMware Aria Operations for Networks. A malicious actor with network access may be able to perform a command injection attack resulting in remote code execution.

A command injection vulnerability was discovered in TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 via the component /userRpm/WlanNetworkRpm.

Type confusion in V8 in Google Chrome prior to version 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.