| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
| Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance. |
| CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation.
This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02. |
| Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack. |
| Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally. |
| Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. |
| Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors.
Details:
- Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`.
- Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator.
- `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there.
- Present since the initial import of the code base (commit `cc9da52`).
- Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `""` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost. |
| Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing. |
