Gitea local code execution through writable Git hooks

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.

Gitea organization listing token scope bypass

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing the intended restriction on the token's delegated access.

Windows NTFS Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally.

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.

Windows Domain Name Service Remote Code Execution Vulnerability

Use after free in DNS Server allows an unauthorized attacker to execute code over a network.

Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

Windows DNS Denial of Service Vulnerability

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

Role: DNS Server Security Feature Bypass Vulnerability

Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature locally.

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Azure DevOps Information Disclosure Vulnerability

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

Windows AppX Deployment Service Tampering Vulnerability

Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.

Windows Work Folders Elevation of Privilege Vulnerability

Use after free in Windows Work Folders allows an authorized attacker to elevate privileges locally.

Microsoft Windows Media Foundation Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally.

Windows DNS Server Remote Code Execution Vulnerability

Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.

Role: DNS Server Tampering Vulnerability

Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.

Windows Overlay Filter Information Disclosure Vulnerability

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Windows Client for NFS Information Disclosure Vulnerability

Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.

Windows Client for NFS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.