| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Stack-based buffer overflow in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Device Inventory allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network. |
| Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network. |
| Use of a broken or risky cryptographic algorithm in Windows DPAPI (Data Protection Application Programming Interface) allows an authorized attacker to elevate privileges locally. |
| A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. |
| In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
| In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network. |
| Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. |
| Time-of-check time-of-use (toctou) race condition in Windows Redirected Drive Buffering allows an authorized attacker to disclose information locally. |
| Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network. |
| Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack. |
| Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743. |
| Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the nvpmgr service, which listens on UDP port 20031 by default. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28744. |
| In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
