Refresh Token Handler Lacks Proof of Possession of Issuer DID in Siglet

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Windows Remote Desktop Protocol Information Disclosure Vulnerability

Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.

Windows NTFS Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.

Windows Storage Management Provider Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally.

Windows Failover Cluster Elevation of Privilege Vulnerability

Double free in Windows Failover Cluster allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows File History Service Elevation of Privilege Vulnerability

Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally.

Windows Partition Management Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to disclose information locally.

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Use after free in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Windows Remote Access Connection Manager Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally.

Windows Spaceport.sys Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack.

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

this is rejected

MISP: Authentication failure logging suppressed during Redis unavailability

Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity. However, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage. Version affected: ≤2.5.45

Win32k Information Disclosure Vulnerability

Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Windows Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Windows Remote Desktop Services Information Disclosure Vulnerability

Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to disclose information locally.

Windows Remote Desktop Licensing Service Information Disclosure Vulnerability

Out-of-bounds read in Windows Remote Desktop Licensing Service allows an authorized attacker to disclose information locally.

Windows NTFS Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Windows Kernel Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to execute code over a network.