| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4. |
| Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0. |
| Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
| Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. |
| Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. |
| Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1. |
| Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1. |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. |
| The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Script Blocking feature to be enabled, and the exploit chain depends on an attacker submitting two coordinated comments — one embedding event-handler syntax inside an allowed <code> element and one placing the deterministic ___noise___ restoration key inside an allowed <abbr title=""> attribute — with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. |
| The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary. |
