Schwachstellen, die jetzt zählen.

Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.

Improper privilege management in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate…

Improper control of generation of code ('code injection') in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group…

Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which TaskEventsHandler.notify() interpolates into a Postgres NOTIFY statement, running stacked queries against the scheduler database.

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the…

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment…

Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only expense report read and create rights can call getAllPayments, getPayments, addPayment, or updatePayment to read, create, or modify payments, falsifying reimbursement state.

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin…

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5).

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

Microsoft Trace Data Helper Elevation of Privilege Vulnerability

Microsoft XPS Document Converter Remote Code Execution Vulnerability

Microsoft Developer Tools: Mehrere Schwachstellen

Visual Studio Code Remote Code Execution Vulnerability

Microsoft Developer Tools: Mehrere Schwachstellen

Visual Studio Code Remote Code Execution Vulnerability

Microsoft Developer Tools: Mehrere Schwachstellen

Visual Studio Code Security Feature Bypass Vulnerability

Microsoft Developer Tools: Mehrere Schwachstellen

Visual Studio Code Security Feature Bypass Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Microsoft Office PowerPoint Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Microsoft Office SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Microsoft Office Outlook Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.