| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02. |
| Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack. |
| Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally. |
| Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. |
| Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.
read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.
A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it. |
| In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors.
Details:
- Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`.
- Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator.
- `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there.
- Present since the initial import of the code base (commit `cc9da52`).
- Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `""` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost. |
| Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing. |
| Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network. |
| Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. |
| Null pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
