InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

Azure Billing Elevation of Privilege Vulnerability

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.

Microsoft Windows Search Component Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

Windows Compressed Folder Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network.

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Microsoft DirectMusic Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

Storage Spaces Controller Information Disclosure Vulnerability

Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to disclose information locally.

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

chromium-browser: chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Windows TCP/IP Denial of Service Vulnerability

Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

chromium-browser: chromium-browser: Race condition in Core

Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Windows Win32k Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

Windows PowerShell Remote Code Execution Vulnerability

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

Windows DNS Remote Code Execution Vulnerability

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

Windows DHCP Server Remote Code Execution Vulnerability

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Windows Network Connection Broker Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.