CVE Vulnerability Catalog

Improper access control vulnerability in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability.

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

A remote peer can exhaust heap memory of a QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for each PATH_CHALLENGE, freed only upon acknowledgment by the remote peer – a malicious peer does not acknowledge, leading to unbounded memory allocation and denial of service. FIPS modules are not affected.

PKCS#12 file processing in OpenSSL fails to validate files using PBMAC1 integrity mechanism, allowing certificate and private key forgery. An attacker impersonating a user can cause a service to accept forged certificates with a 1 in 256 probability.

A heap buffer over-read vulnerability in OpenSSL's ASN.1 decoder occurs when parsing crafted DER structures with primitive elements exceeding 2 GB. Affects 64-bit Unix and Unix-like platforms.

A trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

NVIDIA DALI contains a vulnerability in a component that allows an attacker to cause improper index validation. Successful exploitation could lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA DALI contains a heap-based buffer overflow vulnerability. An attacker could exploit this to achieve code execution, data tampering, denial of service, or information disclosure.

Omnissa Workspace ONE Assist for macOS contains a local privilege escalation vulnerability.

Insufficient input validation vulnerability in NETGEAR JR6150 router allows users connected to local WiFi to execute operating system commands. The router reached end-of-support in 2018 with no further security updates planned.

An information disclosure vulnerability in NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a network-connected user to gain administrator access to the Orbi router.

Mem0 versions up to 0.2.8 have a missing authorization vulnerability in the POST /configure endpoint. Any authenticated user with an API key can change global LLM and embedder configuration, redirecting all traffic to an attacker-controlled server. The malicious configuration persists in PostgreSQL and survives server restarts.

A local privilege escalation vulnerability in Waves Central for macOS versions 13.0.9 through 16.5.5 exists in the privileged helper service. An attacker can exploit a race condition in PID validation to execute code as root. Fixed in version 16.6.2.

Waves Central for macOS versions 13.0.9 through 16.5.5 has a local privilege escalation vulnerability. A trusted XPC client component is signed with entitlements allowing dynamic library injection, enabling a local attacker to execute arbitrary code as root.

Ivanti EPMM before versions 12.9.0.1, 12.8.0.3, and 12.7.0.2 has an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands as root.