CVE Vulnerability Catalog

Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to cause a denial of service over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

A buffer over-read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

A buffer over-read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

Use of an uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

Generation of error messages containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

InstantCMS prior to version 2.18.2 has a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability has been identified in aircheng-org iWebShop-5 up to 5.15, in the member_list function of controllers/member.php, via manipulation of the Search argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The project was informed but has not responded.