Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Windows Bluetooth Port Driver Remote Code Execution

Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally.

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Windows Portable Device File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally.

Windows SMB Server Denial of Service Vulnerability

Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.

Windows Hello Security Feature Bypass Vulnerability

Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.

Windows Event Tracing Elevation of Privilege Vulnerability

Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

Windows Remote POS Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Remote Desktop Client Remote Code Execution Vulnerability

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.

Windows OLE Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.

Windows Update Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

Windows Audio Service Elevation of Privilege Vulnerability

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Windows Broadcast DVR User Service Information Disclosure Vulnerability

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.