Windows Storage Spaces Controller Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Opixido OCMS Admin TUI index.php cross site scripting

A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks.

Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.

Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion

The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its AJAX actions, allowing unauthenticated users to destroy its stored configuration and delete its records.

Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

Microsoft Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

Windows RNDIS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows RNDIS allows an unauthorized attacker to elevate privileges with a physical attack.

Windows Filtering Platform (WFP) Elevation of Privilege Vulnerability

Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

Windows Task Scheduler Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Server for NFS Information Disclosure Vulnerability

Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.

Windows Smart Card Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.

Microsoft Office Word Information Disclosure Vulnerability

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Windows Storport Miniport Driver Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to execute code with a physical attack.

Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip

A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.

JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv

JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse

JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse. The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation. A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.

JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number

JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number. The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps. A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.