Clipboard Permission Control Weakness in Huawei HarmonyOS

Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Denial of Service via Improper Input Validation in Intel AMT Firmware

Improper input validation in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard Manageability may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Windows Narrator Braille Elevation of Privilege Vulnerability

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Microsoft SharePoint Server Information Disclosure Vulnerability

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Microsoft SharePoint Server Tampering Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

Microsoft SharePoint Server Remote Code Execution Vulnerability

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Remote Procedure Call Denial of Service Vulnerability

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

Windows Imaging Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

Windows Encrypting File System (EFS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.

Windows TCP/IP Denial of Service Vulnerability

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

Microsoft Windows Search Component Information Disclosure Vulnerability

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Microsoft COM for Windows Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft COM for Windows allows an authorized attacker to disclose information locally.

Windows Event Logging Service Information Disclosure Vulnerability

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Microsoft Remote Registry Service Denial of Service Vulnerability

Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.