CVE Vulnerability Catalog

Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction in that a victim must open a malicious file.

Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. Exploitation requires physical access to the device.

URL redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. An attacker can lure a user to a malicious address.

Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. Exploitation requires local access to the system.

Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. Exploitation requires local access and privileges.

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. An attacker could leverage this vulnerability to leak data.

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. An attacker may access data they should not be permitted to see.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. An attacker may inject a malicious script into a page.

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.

Path traversal vulnerability in Visual Studio Code allows an authorized attacker to disclose information over a network.

No CWE assigned for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.