CVE Vulnerability Catalog

Integer overflow or wraparound vulnerability in Windows Kerberos. Allows an authorized attacker to execute code over an adjacent network.

In md-fileserver prior to version 1.10.3, an XSS vulnerability exists in the Markdown rendering logic. User-supplied Markdown content with embedded raw HTML, including <script> tags, is processed and injected into the page without sanitization, allowing arbitrary JavaScript execution in the affected domain.

FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.

Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.

A protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.

Untrusted pointer dereference vulnerability in Microsoft Office. An unauthorized attacker can exploit this flaw to execute code locally.

Cross-Site Scripting (XSS) vulnerability in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.

Untrusted pointer dereference vulnerability in Microsoft Office Word. An unauthorized attacker can exploit this flaw to execute code locally.

A type confusion vulnerability in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.

Windows RDP contains an out-of-bounds read vulnerability that allows an unauthorized attacker to disclose information over a network.

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow vulnerability in Windows NTFS driver. An unauthorized attacker can execute code locally, potentially leading to privilege escalation or system compromise.

A type confusion vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.

Out-of-bounds read vulnerability in Windows Hyper-V allows an unauthorized attacker to execute code locally.