CVE Vulnerability Catalog

Elevation of privilege vulnerability in Windows CNG Key Isolation Service. An attacker could exploit it to gain elevated privileges.

Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.

Elevation of privilege vulnerability in Microsoft Exchange Server. Allows an attacker to elevate their privileges in the system.

Elevation of privilege vulnerability in Windows Print Spooler. An attacker could exploit it to gain elevated privileges.

Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The vulnerabilities exist within the underlying protocol used by the component and may allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user.

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

An out-of-bounds write issue in iOS and iPadOS. This issue is fixed in iOS 15.7.1, iPadOS 15.7.1, iOS 16.1, and iPadOS 16. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

The Arm Mali GPU kernel driver mishandles GPU memory operations, allowing unprivileged users to access freed memory (use-after-free). This affects Bifrost, Valhall, and Midgard architectures within specific version ranges.

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8.

An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.

A vulnerability in the Windows COM+ Event System Service allows for elevation of privilege. Technical details are not provided in the description.

A vulnerability in the Windows Print Spooler service allows for elevation of privilege. Technical details are not provided in the description.

A vulnerability in Microsoft Exchange Server allows for remote code execution. Technical details are not provided in the description.

A vulnerability in Microsoft Exchange Server allows for elevation of privilege. Technical details are not provided in the description.

Podatność w interfejsie CLI oprogramowania Cisco SD-WAN może pozwolić uwierzytelnionemu, lokalnemu atakującemu na uzyskanie podwyższonych uprawnień. Problem wynika z niewłaściwych kontroli dostępu do poleceń w aplikacji CLI.

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use-after-free vulnerability in the Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.