CVE Feed

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other (trusted) clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors.

A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /transcation.php. The manipulation of the argument buyer_name leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-210437 was assigned to this vulnerability.

A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.

The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited impact on Confidentiality, Integrity and Availability.

SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as Stack-based buffer overflow.

Windows NTLM Spoofing Vulnerability

Service Fabric Explorer Spoofing Vulnerability

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker to manipulate a firmware update and flash it to the device.

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.

Windows Local Session Manager (LSM) Denial of Service Vulnerability

Windows Mixed Reality Developer Tools Information Disclosure Vulnerability

Active Directory Certificate Services Elevation of Privilege Vulnerability

Windows DHCP Client Elevation of Privilege Vulnerability

Windows Event Logging Service Denial of Service Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Group Policy Preference Client Elevation of Privilege Vulnerability

Windows Group Policy Preference Client Elevation of Privilege Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

Windows Local Session Manager (LSM) Denial of Service Vulnerability

Windows Group Policy Preference Client Elevation of Privilege Vulnerability

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

StorSimple 8000 Series Elevation of Privilege Vulnerability

Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Distributed File System (DFS) Information Disclosure Vulnerability

Windows DHCP Client Information Disclosure Vulnerability

Windows ALPC Elevation of Privilege Vulnerability

Windows USB Serial Driver Information Disclosure Vulnerability

Windows Workstation Service Elevation of Privilege Vulnerability

Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Secure Channel Denial of Service Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Windows Security Support Provider Interface Information Disclosure Vulnerability

Windows CD-ROM File System Driver Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office Graphics Remote Code Execution Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability