CVE Vulnerability Catalog

Information disclosure vulnerability in the Windows Remote Access Connection Manager. It may allow an attacker to access information that should be protected.

Information Disclosure vulnerability in Media Foundation. Could allow an attacker to read data from memory.

Security feature bypass vulnerability in Windows Security Account Manager Remote Protocol. Could allow bypassing authentication security.

Denial of service vulnerability in Windows Hyper-V. Could allow disruption of virtualization services.

A spoofing vulnerability in Microsoft Bing Search allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.

Denial of service vulnerability in Windows DNS Server. Could allow disruption of DNS services.

A vulnerability in Windows Secure Kernel Mode allows a security feature bypass. An attacker could exploit this flaw to bypass kernel protection mechanisms.

A vulnerability in Windows InstallService allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.

When reading a specially crafted ZIP archive or derived formats, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.

When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.

Apache Tomcat versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 incorrectly parsed the HTTP transfer-encoding request header in some circumstances, leading to request smuggling when used with a reverse proxy. Specifically, Tomcat ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response, honored the identity encoding, and did not ensure that chunked encoding was the final encoding.

Authenticated reflective XSS was identified in HelpDeskTab/rcResults.asp. The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page, allowing a Cross-Site Scripting attack. The same issue exists for the parameter FileName of /done.asp.

A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.

A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.

A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into the victim's browser via the web application.

Mikrotik RouterOS 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

Mikrotik RouterOS 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.

In MISP before version 2.4.146, there is a stored XSS vulnerability in the sharing groups view located in app/View/SharingGroups/view.ctp.

An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.