| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. |
| The cstruct package before 6.3.0 for OCaml mishandles indexes. |
| Use after free in Windows Credential Providers allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. |
| In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. |
| The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout. |
| Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize in src/lstm/networkio.cpp but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart unchecked. In LSTM::Forward in src/lstm/lstm.cpp, source_ is sized from the independently deserialized na_ field while the WriteTimeStepPart count is ns_, which comes from the CI gate WeightMatrix dim1() value. A crafted NT_LSTM layer can make ns_ much larger than na_, causing a heap out-of-bounds write during the first recognition step on the default LSTM engine and resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review. |
