CVE Vulnerability Catalog

Integer overflow vulnerability in Windows Storage Spaces Direct. Allows an unauthorized attacker to execute code via a physical attack.

Integer overflow vulnerability in Windows Spaceport.sys. Allows an unauthorized attacker to elevate privileges via a physical attack.

Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally.

Windows Kernel exposes sensitive system information to unauthorized actors, allowing an unauthorized attacker to disclose information locally.

Windows DirectX exposes sensitive information to unauthorized actors, allowing an unauthorized attacker to disclose information locally.

A heap-based buffer overflow in the Windows USB Video Driver allows an unauthorized attacker to elevate privileges through a physical attack.

Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

Uncontrolled resource consumption in Windows LSASS allows an authorized attacker to cause a denial of service over the network.

A vulnerability in the Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information through a physical attack. The issue stems from an out-of-bounds read.

Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges via a physical attack.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allow an unauthorized attacker to disclose information over a network.

A path traversal vulnerability in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

A vulnerability in Windows File Explorer allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.

Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

A stored XSS vulnerability in osTicket versions 1.10 to 1.17.7 and 1.18.0 to 1.18.3, caused by a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allows remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

A vulnerability in Windows Media allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.