Schwachstellen, die jetzt zählen.

Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate…

Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

thunderbird: Attachments could be replaced with local file content when forwarding

inet: reject unhashed sockets during established lookups

kernel: kernel: Denial of Service via race condition in TCP socket lookup

git: Mehrere Schwachstellen

git: git: Arbitrary file system access via fast-import features

git: Mehrere Schwachstellen

git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones

git: Mehrere Schwachstellen

git: git: Heap corruption via integer overflow in merge size calculations

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. ## Announcement Announcement for this issue can be found at…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion. ## Announcement Announcement for this issue can be found at…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations. A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:**…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service. ## Announcement Announcement for this issue can be found at…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. The Blazor/SignalR `/_blazor/refresh` path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/506 ##…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/515 ## CVSS Details - **Version:** 3.1 - **Severity:**…

Microsoft Developer Tools: Mehrere Schwachstellen

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Managed `HttpListener` can recursively process an unterminated request line and exhaust the process stack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/500 ## CVSS Details - **Version:** 3.1 - **Severity:** High -…

Microsoft Developer Tools: Mehrere Schwachstellen

dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group…

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment…

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin…

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5).

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Windows Storage Spaces Controller Remote Code Execution Vulnerability