| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access. |
| Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network. |
| LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap. |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. |
| Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
| An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. |
| Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
| Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. |
| Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. |
| IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive. |
| IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system. |
