CVE Feed

Windows DNS Server Remote Code Execution Vulnerability

Windows AD FS Security Feature Bypass Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

Windows Event Tracing Elevation of Privilege Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows TCP/IP Driver Denial of Service Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Open Enclave SDK Elevation of Privilege Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Windows Installer Spoofing Vulnerability

Windows Key Distribution Center Information Disclosure Vulnerability

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Media Foundation Information Disclosure Vulnerability

Windows Desktop Bridge Elevation of Privilege Vulnerability

Windows Hyper-V Denial of Service Vulnerability

Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability

Windows DNS Snap-in Remote Code Execution Vulnerability

Windows Hyper-V Denial of Service Vulnerability

Windows DNS Server Remote Code Execution Vulnerability

Microsoft Bing Search Spoofing Vulnerability

Windows DNS Snap-in Remote Code Execution Vulnerability

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Windows DNS Snap-in Remote Code Execution Vulnerability

Windows DNS Snap-in Remote Code Execution Vulnerability

Windows DNS Server Remote Code Execution Vulnerability

Windows DNS Server Denial of Service Vulnerability

Windows Secure Kernel Mode Security Feature Bypass Vulnerability

Windows Projected File System Elevation of Privilege Vulnerability

Windows Media Remote Code Execution Vulnerability

Power BI Remote Code Execution Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows InstallService Elevation of Privilege Vulnerability

HEVC Video Extensions Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Windows TCP/IP Driver Denial of Service Vulnerability

Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.

SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.

Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream.

A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information.

A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header.

A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.

Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID.