CVE Feed

Windows Kernel Elevation of Privilege Vulnerability

Windows GDI+ Information Disclosure Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Geolocation Service Remote Code Execution Vulnerability

Storage Spaces Controller Information Disclosure Vulnerability

Win32k Information Disclosure Vulnerability

Windows Storage Elevation of Privilege Vulnerability

Tile Data Repository Elevation of Privilege Vulnerability

Windows Security Center API Remote Code Execution Vulnerability

Windows Event Tracing Elevation of Privilege Vulnerability

Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability

Clipboard User Service Elevation of Privilege Vulnerability

Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability

Windows Devices Human Interface Elevation of Privilege Vulnerability

Windows Push Notifications Apps Elevation of Privilege Vulnerability

Windows System Launcher Elevation of Privilege Vulnerability

Connected Devices Platform Service Elevation of Privilege Vulnerability

Windows StateRepository API Server file Elevation of Privilege Vulnerability

Windows UI Immersive Server API Elevation of Privilege Vulnerability

Windows Application Model Core API Elevation of Privilege Vulnerability

Task Flow Data Engine Elevation of Privilege Vulnerability

Windows AppContracts API Server Elevation of Privilege Vulnerability

Windows Accounts Control Elevation of Privilege Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Windows Bind Filter Driver Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Windows DWM Core Library Elevation of Privilege Vulnerability

Remote Desktop Client Remote Code Execution Vulnerability

Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Remote Desktop Client Remote Code Execution Vulnerability

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Windows Hyper-V Denial of Service Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Word Remote Code Execution Vulnerability

Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability

Windows Cleanup Manager Elevation of Privilege Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Windows Certificate Spoofing Vulnerability

Microsoft Cryptographic Services Elevation of Privilege Vulnerability

Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability

Virtual Machine IDE Drive Elevation of Privilege Vulnerability

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body.

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.