CVE Vulnerability Catalog

Denial of service vulnerability in Windows Lightweight Directory Access Protocol (LDAP). An attacker could cause the LDAP service to crash, preventing access to directories.

A Denial of Service vulnerability in Windows Network Address Translation (NAT) allows an attacker to cause service failure or unavailability. The attack can be performed remotely without authentication.

Denial of service vulnerability in Windows Network Address Translation (NAT). An attacker could cause the NAT service to crash, potentially disrupting network connectivity.

Remote code execution vulnerability in the Windows kernel. Allows an attacker to execute code with elevated privileges.

Information disclosure vulnerability in the Windows kernel. It may allow an attacker to access data that should be protected.

A vulnerability in the Windows USB Generic Parent Driver allows remote code execution.

A vulnerability in Trusted Compute Base allows elevation of privilege. Technical details are not provided in the description.

A vulnerability in Skype for Business allows information disclosure.

Denial of Service vulnerability in Windows Hyper-V. An attacker can cause failure or unavailability of virtualization services.

A spoofing vulnerability in Azure Stack Hub allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.

A path traversal vulnerability in Undertow may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the search bar component.

When a user scans a QR code with the QR Code Scanner feature, they are not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. This vulnerability affects Firefox for iOS < 129.

A Cross Site Scripting (XSS) vulnerability in Stimulsoft Dashboard.JS before version 2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload in the ReportName field.

A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161 allows privilege escalation via stored XSS in the switch group function. An attacker can gain installer or PM rights and then administrative access to the web portal.

W Mbed TLS w wersjach 2.x przed 2.28.7 oraz 3.x przed 3.5.2 odkryto problem związany z czasowym kanałem bocznym w operacjach prywatnych RSA. Taki kanał boczny może umożliwić lokalnemu atakującemu odzyskanie tekstu jawnego.

Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets.

An issue in the official Plone Docker image version 5.2.13 (5221) allows remote code execution due to improper validation of HOST headers.

Since version 5.2.0, when using deferrable mode with a Kubernetes configuration file for authentication, the Airflow worker serializes this file as a dictionary and stores it in metadata without encryption. In versions 2.3.0-2.6.0, the dictionary is also logged as plain text in the triggerer service. This allows anyone with access to metadata or logs to obtain the configuration file and access the Kubernetes cluster.

In the Linux kernel, in the ext4 filesystem (file super.c), there is a use-after-free flaw in __ext4_remount. This occurs when freeing old quota file names before a potential failure, leading to an information leak.