Schwachstellen, die jetzt zählen.

Microsoft Windows AppX Installer Spoofing Vulnerability

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts…

Microsoft Windows Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API

Grafana Path Traversal Vulnerability

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: ` /public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains…

Google Chromium V8 Memory Corruption Vulnerability

Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Excel Security Feature Bypass

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows Installer Privilege Escalation Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Draytek VigorConnect Path Traversal Vulnerability

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Draytek VigorConnect Path Traversal Vulnerability

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Microsoft Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

Google Chromium V8 Use-After-Free Vulnerability

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Google Chromium V8 Out-of-Bounds Write Vulnerability

Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

D-Link DIR-605 Router Information Disclosure Vulnerability

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

Microsoft MSHTML Remote Code Execution Vulnerability

Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users…

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Open Management Infrastructure Elevation of Privilege Vulnerability

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Apple macOS Unspecified Vulnerability

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

Apple iOS WebKit Buffer Overflow Vulnerability

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Apple Multiple Products WebKit Integer Overflow Vulnerability

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.