Windows Hyper-V Denial of Service Vulnerability

Use after free in Windows Hyper-V allows an unauthorized attacker to deny service over a network.

Windows OLE Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.

Windows App Readiness Service Tampering Vulnerability

Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.

GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown

GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.

GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached

HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached. The session id from the client's cookie reaches memcached unchanged as the cache key. A CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.

Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Data Sharing Service Client Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.

Remote Desktop Client Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Windows USB Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Windows Connection Manager Service Elevation of Privilege Vulnerability

Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally.

Windows Secure Kernel Mode Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

Busybox: heap buffer overflow in the tftp client on fallback to the default block size

A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP server can exploit this issue by sending standard-sized network packets during a transfer, causing a heap buffer overflow. This flaw allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing the application.

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.