CVE Feed

sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link, to successfully execute malicious code, which could potentially steal cookies, session data, or local storage data from the app the sidekiq-unique-jobs web UI is mounted in. 1. `/changelogs`, 2. `/locks` or 3. `/expiring_locks`. This issue has been addressed in versions 7.1.33 and 8.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Internet Shortcut Files Security Feature Bypass Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Windows Printing Service Spoofing Vulnerability

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

Microsoft Azure File Sync Elevation of Privilege Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft Office OneNote Remote Code Execution Vulnerability

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Windows DNS Information Disclosure Vulnerability

Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability

Microsoft Teams for Android Information Disclosure Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Windows Kernel Security Feature Bypass Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability

Internet Connection Sharing (ICS) Denial of Service Vulnerability

Microsoft ODBC Driver Remote Code Execution Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Network Address Translation (NAT) Denial of Service Vulnerability

Windows Network Address Translation (NAT) Denial of Service Vulnerability

Windows DNS Client Denial of Service Vulnerability

Windows Kernel Remote Code Execution Vulnerability

Windows USB Generic Parent Driver Remote Code Execution Vulnerability

Windows Hyper-V Denial of Service Vulnerability

Dynamics 365 Sales Spoofing Vulnerability

Skype for Business Information Disclosure Vulnerability

Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability

Trusted Compute Base Elevation of Privilege Vulnerability

Azure Stack Hub Spoofing Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Microsoft Outlook Elevation of Privilege Vulnerability

Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability

Dynamics 365 Sales Spoofing Vulnerability

Dynamics 365 Field Service Spoofing Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability