A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.

Insufficient Input Validation Vulnerability in NETGEAR Orbi RBR350

An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the integrity of the affected device.

Missing Authentication Vulnerability in NETGEAR Nighthawk RAX30 models

A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This affects the confidentiality, integrity and availability of the router.

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.

rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.

rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability

Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Performance Monitor Remote Code Execution Vulnerability

Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Audio Service Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Windows Clipboard Virtual Channel Extension Elevation of Privilege Vulnerability

Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.

HID Parser Library Elevation of Privilege Vulnerability

Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow vulnerability

Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.

Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Windows Sensor Data Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability

Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.