CVE Vulnerability Catalog

Denial of Service vulnerability in Connected User Experiences and Telemetry Service due to improper validation of certain function values. An attacker must log on to the system and run a specially crafted application to exploit it, potentially denying dependent security feature functionality.

Denial of service vulnerability in Windows due to improper handling of objects in memory.

Information disclosure vulnerability in Windows Subsystem for Linux due to improper handling of objects in memory. An attacker could obtain information to further compromise the user's system.

Information disclosure vulnerability in the Windows kernel due to improper handling of objects in memory. An attacker must be logged on and run a specially crafted application. The vulnerability does not allow code execution or privilege escalation, but could be used to obtain information.

Elevation of privilege vulnerability in Windows due to improper handling of errors tied to Remote Access Common Dialog.

Remote code execution vulnerability in the ChakraCore scripting engine. An attacker can exploit this flaw to execute arbitrary code in the context of the current user, potentially leading to system compromise if the user has administrative rights.

Cross-site scripting vulnerability in Microsoft Dynamics 365 (on-premises) due to improper sanitization of crafted web requests. An authenticated attacker could perform XSS attacks and run scripts in the security context of the current authenticated user.

A spoofing vulnerability in Microsoft Edge due to improper parsing of HTTP content. An attacker can trick a user by redirecting to a specially crafted website that can spoof content or serve as a pivot for further attacks. Requires user clicking a specially crafted URL.

An elevation of privilege vulnerability in Microsoft Edge due to improper enforcement of cross-domain policies. An attacker could access information from one domain and inject it into another.

A cross-site-scripting (XSS) vulnerability in Active Directory Federation Services (ADFS) due to improper sanitization of user inputs. An unauthenticated attacker can send a crafted request to an affected ADFS server, and upon successful exploitation, perform XSS attacks and run scripts in the current user's security context.

Remote code execution vulnerability in the Chakra scripting engine in Microsoft Edge (HTML-based). An attacker can exploit this flaw to execute arbitrary code in the context of the current user, potentially leading to system compromise if the user has administrative rights. The attack can be carried out via a specially crafted website.

An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.

In MISP versions before 2.4.126, there is an XSS vulnerability in the resolved attributes view in app/View/Events/resolved_attributes.ctp.

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one.

iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. Security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.

In the Linux kernel versions 4.18 through 5.6.11, when unprivileged user namespaces are allowed, a user can create their own PID namespace and mount a FUSE filesystem. If the userspace component is terminated via a kill of the PID namespace's pid 1, it can result in a hung task and resources being permanently locked up until system reboot, leading to resource exhaustion.

A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass configured file policies. The issue is due to errors in how Snort handles specific HTTP responses. An attacker could send crafted HTTP packets through an affected system, potentially bypassing policies and delivering a malicious payload.

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch. This is due to improper verification of digital signatures for patch images. An attacker could exploit this by crafting an unsigned patch to bypass signature checks, potentially booting a malicious patch image.

A vulnerability in the TLS 1.3 policy with URL category functionality for Cisco FTD Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The issue is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this by sending crafted TLS 1.3 connections, bypassing the policy and accessing URLs that would normally be dropped.