CVE Vulnerability Catalog

A race condition in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Improper access control vulnerability in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally.

Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.

OpenSSL has a NULL pointer dereference vulnerability when OCSP response checking for the whole chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) are enabled. If the chain lacks a self-signed trusted anchor, a NULL dereference crashes the process.

Vulnerability in OpenSSL QUIC server. Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference when address validation is disabled, causing abnormal termination of the QUIC server process and denial of service. By default, address validation is enabled, so the default configuration is not vulnerable.

The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.

Svelte framework versions 5.51.5 through 5.55.6 have a ReDoS vulnerability in <svelte:element this={tag}></svelte:element>. An internal regex can take exponential time to test.

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

A cross-site scripting (XSS) vulnerability in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.

Improper access control vulnerability in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability.

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

A remote peer can exhaust heap memory of a QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for each PATH_CHALLENGE, freed only upon acknowledgment by the remote peer – a malicious peer does not acknowledge, leading to unbounded memory allocation and denial of service. FIPS modules are not affected.

PKCS#12 file processing in OpenSSL fails to validate files using PBMAC1 integrity mechanism, allowing certificate and private key forgery. An attacker impersonating a user can cause a service to accept forged certificates with a 1 in 256 probability.

A heap buffer over-read vulnerability in OpenSSL's ASN.1 decoder occurs when parsing crafted DER structures with primitive elements exceeding 2 GB. Affects 64-bit Unix and Unix-like platforms.

A trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.