| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2. |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker can use those response differences to enumerate valid CRM usernames and target confirmed accounts with password spraying, credential stuffing, brute-force, or social-engineering attacks. This issue is fixed in versions 7.15.2 and 8.10.2. |
| Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network. |
| Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network. |
| Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally. |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally. |
| Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
| Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally. |
