CVE Vulnerability Catalog

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability resides in the database component and requires prior access to the system.

Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. Resource exhaustion may render the service unavailable.

Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. The vulnerability can be exploited remotely without authentication, posing a serious threat.

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability can be exploited to gain higher privileges on the system.

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. The vulnerability can be exploited to remotely read data.

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability can be exploited to gain higher privileges on the system.

An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.

A heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

A use-after-free vulnerability in SQL Server allows an authorized attacker to elevate privileges locally.

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification, and repeated requests may degrade service availability.

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction - a victim must open a malicious file.

Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction - a victim must open a malicious file.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. The vulnerability affects the database component and requires valid credentials.

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction - a victim must open a malicious file.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate unexpectedly or lead to out-of-bounds memory reads and writes, which may result in the disclosure of adjacent process memory into local system logs.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation depends on conditions beyond the attacker's control, does not require user interaction. Scope is changed.