CVE Vulnerability Catalog

Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

A use-after-free vulnerability in Windows Server allows an authorized attacker to elevate privileges locally.

A use-after-free vulnerability in the Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

A double-free vulnerability in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

InstantCMS prior to version 2.18.2 has a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

A race condition in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

InstantCMS versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability has been identified in aircheng-org iWebShop-5 up to 5.15, in the member_list function of controllers/member.php, via manipulation of the Search argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The project was informed but has not responded.

In n8n, an open source workflow automation platform, prior to versions 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

A NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS, FortiPAM and FortiProxy. An authenticated attacker can send crafted HTTP requests to crash the httpsd daemon.

Fortinet FortiAnalyzer versions 7.6.3–7.6.6 contain a use of uninitialized variable vulnerability. An attacker can cause a denial of service via SNMP GETBULK requests.

A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.

Fortinet FortiSandbox contains a command injection vulnerability (CWE-77) due to improper neutralization of special elements used in commands. A privileged attacker may execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects versions 5.2.0, 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions.

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7 and 7.2 all versions may allow attacker to improper access control via an exposed minifilter communication port.

An improper access control vulnerability in Fortinet FortiSOAR (PaaS and on-premise) across multiple versions (7.3 to 7.6.6) may allow an attacker to escalate privileges. The attack vector is not specified.

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.