CVE Feed

Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.

Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network.

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.

Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network.

Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.

Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.

Heap-based buffer overflow in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows NTLM allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to deny service over an adjacent network.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.