CVE Vulnerability Catalog

A heap-based buffer overflow in the Windows USB Video Driver allows an unauthorized attacker to elevate privileges through a physical attack.

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

Uncontrolled resource consumption in Windows LSASS allows an authorized attacker to cause a denial of service over the network.

A vulnerability in the Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information through a physical attack. The issue stems from an out-of-bounds read.

Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges via a physical attack.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allow an unauthorized attacker to disclose information over a network.

A path traversal vulnerability in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

A vulnerability in Windows File Explorer allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.

Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

A stored XSS vulnerability in osTicket versions 1.10 to 1.17.7 and 1.18.0 to 1.18.3, caused by a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allows remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

A vulnerability in Windows Media allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.

A protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

A vulnerability in Windows Audio Service allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.

A vulnerability in Windows File Explorer allows an authorized attacker to disclose sensitive information locally.

A security vulnerability was found in tamagui up to version 2.3.0, involving uncontrolled modification of object prototype attributes in the updateConfig function of config.ts. The attack can be performed remotely.