| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
| Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
| Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network. |
| Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. |
| Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
| Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
| Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
| Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally. |
| Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally. |
| Buffer over-read in Windows Wired AutoConfig Service allows an authorized attacker to disclose information locally. |
| Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network. |
| Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network. |
| Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally. |
| All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester. |
| The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. |
