Windows Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Failover Cluster Elevation of Privilege Vulnerability

Use after free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.

Windows IP Translation Configuration Service Elevation of Privilege Vulnerability

Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally.

Windows USB Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Photoshop Desktop | Out-of-bounds Read (CWE-125)

Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Data Deduplication Security Feature Bypass Vulnerability

Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.

Windows Installer Information Disclosure Vulnerability

Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

MISP Modules Website: Missing Authorization on External Tool Management Endpoints

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

Microsoft Office Excel Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Audition | Improper Input Validation (CWE-20)

Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Win32k Information Disclosure Vulnerability

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Windows Subsystem for Linux Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows Blind SQL Injection.This issue affects wpDataTables: from n/a through 7.4.

SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft

Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption.

歸類為 JSONCPP Open Source 之問題

Awx: webhook credential assignment omits use_role check, exposing another user's token

An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits.

Premiere Pro | NULL Pointer Dereference (CWE-476)

Premiere Pro is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.