CVE Vulnerability Catalog

A spoofing vulnerability in Windows LSA (Local Security Authority).

An elevation of privilege vulnerability in Windows Event Tracing.

An elevation of privilege vulnerability in the Windows User Profile Service.

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier.

Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A vulnerability in Atlassian Confluence Server allows remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read in the /s/ endpoint. Affected versions are before 7.4.10 and from 7.5.0 before 7.12.3.

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system.

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attacker to upload arbitrary files on affected installations. An attacker must first obtain the ability to logon to the product's management console.

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier.

An elevation of privilege vulnerability exists due to overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker could run arbitrary code with SYSTEM privileges, install programs, view/change/delete data, or create new accounts with full user rights.

Memory corruption vulnerability in the scripting engine. It could allow remote code execution in the context of the logged-in user.

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

Elevation of privilege vulnerability in Microsoft Exchange Server. Allows an attacker to elevate their privileges in the system.

Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code remotely on the server.

Elevation of privilege vulnerability in Windows Kernel. Could be exploited to gain administrative privileges.

Information disclosure vulnerability in Microsoft Exchange Server. Allows an attacker to access sensitive information.

Elevation of privilege vulnerability in Windows Kernel. Could be exploited to gain administrative privileges.

A remote code execution vulnerability in Microsoft Exchange Server.

Kaseya VSA before 9.5.7 allows credential disclosure. The default download page (dl.asp) is unauthenticated and generates KaseyaD.ini with Agent_Guid and AgentPassword, which can be used to obtain a sessionId and bypass authentication.

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.