Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

Windows Win32k Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

Win32k Information Disclosure Vulnerability

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network.

Windows Audio Service Elevation of Privilege Vulnerability

Double free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Windows Shell Spoofing Vulnerability

Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Windows Print Spooler Components Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability

Use after free in Windows AF_UNIX Socket Provider allows an authorized attacker to elevate privileges locally.

Windows Display Enhancement Service Elevation of Privilege Vulnerability

Double free in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.

Windows Defender Firewall Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.

Windows Spaceport.sys Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data that begins with many '\0' characters, possibly related to DNS.

ThinOS 10 Security Version Number Downgrade Vulnerability Allows Protection Mechanism Bypass

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

service-ca-operator: Operator ServiceAccount bound to cluster-admin

No description is available for this CVE.

Unauthenticated Physical Access Allows Arbitrary Code Execution via Download of10

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution.

Remote Command Injection Vulnerability in Dell ThinOS 10

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNECT with a keep-alive non-2xx response and does not drain the body, Traefik returns the desynchronized backend socket to its shared pool and reuses it for other clients. An unauthenticated attacker can use this behavior to make a different client read the attacker's smuggled response, which can include authenticated or private content from another request. The ForwardAuth middleware with forwardBody true and preserveRequestMethod true can re-issue a CONNECT with the buffered body attached, exposing the auth-client pool to the same desynchronization. This issue is fixed in 2.11.53, 3.6.24, and 3.7.9.