Schwachstellen, die jetzt zählen.

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft Office Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Teams Spoofing Vulnerability

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Microsoft Developer Tools: Mehrere Schwachstellen

Visual Studio Code Security Feature Bypass Vulnerability

Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding

### Summary RSASSA-PKCS1-v1_5 signature verification (`publicKey.verify()` with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1…

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA Part 3, §5.2.9, where nodes without an explicit `RolePermissions` attribute inherit the namespace `DefaultRolePermissions`. OPC 10000-3 §4.8.3 mandates a **default-deny** evaluation (`Bad_UserAccessDenied` when the operation bits are not set)…

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives.

Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service…

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0…

In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin…

V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that…

V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or…

Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling.

Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound. Impact Exploitation can exhaust process…

Podman: Schwachstelle ermöglicht Denial of Service

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs…

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Same-origin policy bypass in the CSS Parsing and Computation component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Incorrect boundary conditions in the Graphics component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Invalid pointer in the JavaScript Engine: JIT component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component

Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

firefox: thunderbird: Information disclosure in the Marionette component