Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance.

Insecure Storage of Sensitive Information Allowing File Manipulation in Johnson Controls iSTAR Devices

CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

Windows Kernel Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Kernel Information Disclosure Vulnerability

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack.

Windows PCI Bus Driver Elevation of Privilege Vulnerability

Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Windows Subsystem for Linux Elevation of Privilege Vulnerability

Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Microsoft DirectMusic Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.

Windows Remote Desktop Client Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally.

Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Windows TCP/IP Elevation of Privilege Vulnerability

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing.

Windows Overlay Filter Information Disclosure Vulnerability

Numeric truncation error in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Windows Defender Firewall Service Elevation of Privilege Vulnerability

Double free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Windows Broadcast DVR User Service Elevation of Privilege Vulnerability

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network.

Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Windows Installer Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.