| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization. |
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user. |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. |
| Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally. |
| Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. |
| Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
| Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally. |
| Null pointer dereference in Windows Schannel allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. |
| Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. |
