In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade due to improper input validation. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Directory Traversal in Janus WebRTC Server Allows Unauthenticated File Read

Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler

Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Spoofing issue in the Security component

Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Undefined behavior in the WebRTC: Networking component

Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Windows Kernel Transaction Manager Information Disclosure Vulnerability

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

vhdmp.sys Elevation of Privilege Vulnerability

Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

Permission Bypass in Android CPM Module Allows Local Privilege Escalation

In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.