| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| During Xenstore live update the state record for a Xenstore watch with
specified watch depth is written with two bytes missing. This results
in an inconsistent state when reading the state back in the new Xenstore,
causing a crash of Xenstore or wrong Xenstore data. |
| iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata. |
| The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite. |
| Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval. |
| Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. |
| Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
| Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. |
| Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch. |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
| Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. |
| Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. |
| FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0. |
