Windows Setup Files Cleanup Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

volotat Anagnorisis page.html start_streaming path traversal

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_streaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

DbGate files-style Endpoint files.js fs.readFile path traversal

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.

Windows Spaceport.sys Remote Code Execution Vulnerability

Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.

Windows Spaceport.sys Elevation of Privilege Vulnerability

Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows Speech Tampering Vulnerability

Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.

Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal.

Windows Push Notifications Elevation of Privilege Vulnerability

Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Windows Win32k Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.

Windows Print Spooler Components Elevation of Privilege Vulnerability

Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Windows Shell Elevation of Privilege Vulnerability

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.

Out-of-Bounds Operator-Code Lookup During Model Loading in Samsung ONE

Missing bounds validation for operator could allow out of range operator-code lookup during model loading Affected version is prior to commit 1.30.0.

Ops Manager RCE via webhook body

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.  This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

PHP Stack Exhaustion

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

Calling createIndex with certain index types can crash mongod

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

Heap memory out of bounds read and crash in C Driver legacy GridFS file reader

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).