| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here> |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
| Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
| Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally. |
| When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context. |
| Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. |
| Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network. |
| Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
