CVE Vulnerability Catalog

Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction in that a victim must open a malicious file.

Improper validation of generative AI output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

The Visual Studio Code CoPilot Chat Extension contains a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. An authorized attacker can locally bypass a security feature.

A command injection vulnerability in Visual Studio allows an authorized attacker to execute code locally. It stems from improper neutralization of special elements used in commands.

A vulnerability in Microsoft Dynamics 365 (on-premises) involves exposure of sensitive information to an unauthorized actor. An unauthenticated attacker can disclose information over a network.

An untrusted pointer dereference vulnerability exists in Microsoft Office Excel. An unauthorized attacker can disclose information over a network.

A path traversal vulnerability in OneDrive for Android allows an authorized attacker to elevate privileges over a network. It stems from improper limitation of a pathname to a restricted directory.

Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Microsoft Configuration Manager contains improper access control allowing an authorized attacker to elevate privileges locally. The vulnerability requires valid credentials but no user interaction.

Uncontrolled search path in Intel MPI Library before version 2021.16 within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this to escalate privileges.

Protection mechanism failure in UEFI firmware for Slim Bootloader may allow privilege escalation. A privileged user with local access and high attack complexity could exploit this without user interaction.

NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where an attacker could cause a stack overflow by sending extra-large payloads. A successful exploit may lead to denial of service.

NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successful exploit of this vulnerability may lead to information disclosure.

Intel(R) QAT Windows software before version 2.6.0 contains a buffer overflow in Ring 3 (user applications) that may allow denial of service. The attack requires an authenticated user and local access, with no user interaction.

Unquoted search path in PRI Driver software before version 03.03.1002 within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this.

Intel QuickAssist Technology software before version 2.6.0 contains an untrusted pointer dereference in Ring 3 (user applications) that may allow privilege escalation. The attack requires an authenticated user and local access, with no user interaction.

Uncontrolled search path in FPGA Support Package for Intel oneAPI DPC++/C++ Compiler before version 2025.0.1 within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this.

Uncontrolled search path in Intel Processor Identification Utility before version 8.0.43 within Ring 3 user applications may allow privilege escalation. An authenticated user with local access and user interaction could exploit this.

Incorrect default permissions in Intel(R) Thread Director Visualizer software before version 1.1.1 may allow an authenticated user to escalate privileges. The attack requires local access, high complexity, and user interaction, and may impact confidentiality, integrity, and availability.

An out-of-bounds read in Intel(R) QAT Windows software before version 2.6.0 may allow an authenticated user to cause a denial of service. The attack requires local access and high complexity but no user interaction, impacting system availability.