CVE Vulnerability Catalog

Information Disclosure vulnerability in Media Foundation. Could allow an attacker to read data from memory.

Security feature bypass vulnerability in Windows Security Account Manager Remote Protocol. Could allow bypassing authentication security.

Denial of service vulnerability in Windows Hyper-V. Could allow disruption of virtualization services.

A spoofing vulnerability in Microsoft Bing Search allows an attacker to impersonate a trusted resource or user. Exploitation could lead to tricking users and disclosing sensitive information.

Denial of service vulnerability in Windows DNS Server. Could allow disruption of DNS services.

A vulnerability in Windows Secure Kernel Mode allows a security feature bypass. An attacker could exploit this flaw to bypass kernel protection mechanisms.

A vulnerability in Windows InstallService allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.

When reading a specially crafted ZIP archive or derived formats, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.

When reading a specially crafted TAR archive, an Apache Ant build can be made to allocate large amounts of memory, leading to an out-of-memory error even for small inputs. This can disrupt builds using Apache Ant. Versions prior to 1.9.16 and 1.10.11 are affected.

Apache Tomcat versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 incorrectly parsed the HTTP transfer-encoding request header in some circumstances, leading to request smuggling when used with a reverse proxy. Specifically, Tomcat ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response, honored the identity encoding, and did not ensure that chunked encoding was the final encoding.

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Authenticated reflective XSS was identified in HelpDeskTab/rcResults.asp. The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page, allowing a Cross-Site Scripting attack. The same issue exists for the parameter FileName of /done.asp.

A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.

A cross-site request forgery (CSRF) vulnerability was found in XYHCMS V3.6 at the URI /xyhai.php?s=/Auth/editUser. It allows an attacker to modify administrator information, including name, email, and password.

A cross-site scripting (XSS) vulnerability was found in baigo CMS v4.0-beta-1. Attackers can inject arbitrary JavaScript or HTML code via the 'post' parameter sent to /public/console/profile/info-submit/.

In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into the victim's browser via the web application.

Realtek HAD contains a driver crashed vulnerability which allows local side attackers to send a special string to the kernel driver in a user’s mode. Due to unexpected commands, the kernel driver will cause the system crashed.

Mikrotik RouterOS 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

Mikrotik RouterOS 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.