An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. A local attacker may be able to elevate their privileges.


The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers effectively blocking the access to the dashboard.


A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.


An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files because of _createUserdataConf in install/lib/class.FroxlorInstall.php.


GitLab through 12.9 is affected by a potential DoS in repository archive download.


Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process a textual protocol is found which contains a simple header with the requested command application-identifier and some arguments. The protocol is vulnerable to DoS through an arbitrary pointerderreference. This flaw allows an attacker to to pass a specially crafted package that when processed by theservice causes an arbitrary pointer from the stack to be dereferenced causing an uncaught exception thatterminates the service. This can be further contructed in combination with RVDP#710 which exploits an informationdisclosure leak or with RVDP#711 for an stack-overflow and potential code execution.Beyond denying simulations Visual Components provides capabilities to interface with industrial machinery andautomate certain processes (e.g. testing benchmarking etc.) which depending on the DevOps setup might beintegrated into the industrial flow. Accordingly a DoS in the simulation might have higher repercusions dependingon the Industrial Control System (ICS) ICS infrastructure.


The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver. If the user provides a NULL entry for the dwIoControlCode parameter a kernel panic (aka BSOD) follows. The IOCTL codes can be found in the dispatch function: 0x8001E000 0x8001E004 0x8001E008 0x8001E00C 0x8001E010 0x8001E014 0x8001E020 0x8001E024 0x8001E040 0x8001E044 and 0x8001E048. \\DosDevices\\AscRegistryFilter and \\Device\\AscRegistryFilter are affected.


A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.


A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 tvOS 13.3.1 Safari 13.0.5 iTunes for Windows 12.10.4 iCloud for Windows 11.0 iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. A download's origin may be incorrectly associated.


An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.


A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.


A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.


An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots of the Messages app may reveal additional message content.


A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17 iTunes 12.10.4 for Windows iCloud for Windows 10.9.2 tvOS 13.3.1 Safari 13.0.5 iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.


A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.


An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution.


An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A remote FaceTime user may be able to cause the local user's camera self-view to display the incorrect camera.


Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3 as used by Shekar Endoscope allow a TELNET connection with the molinkadmin password for the molink account.


Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon as it is received (before the transaction is confirmed) and does not decrease the balance when it is canceled. As a result users are exposed to basic double spending attacks amplified double spending attacks and DoS attacks without user consent.


The frame touch module does not make validity judgments on parameter lengths when processing specific parameters which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on the device.


** DISPUTED ** gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states \We are already on a shutdown path when running the code in question so a DoS there doesn't make any sense and there has been no additional information provided us (as upstream) to indicate why this would be a problem.\


The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore passing invalid URL objects could be used for DOS'ing Grafana via SegFault.


A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6 <13.3.9.


A potential DOS vulnerability was discovered in GitLab versions 13.1 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.


An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it potentiality resulting in a host DoS.


QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.


Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.


Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes resulting in DoS for a host.


QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes resulting in DoS for a host.


An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart resulting in a Denial-of-Service (DoS).


Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory resulting in DoS for a host.


Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1) M(6.0) and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack or possibly gain privileges. The Samsung ID is SVE-2016-7119.


Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory resulting in DoS for a host.


Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1) M(6.0) and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack or possibly gain privileges. The Samsung ID is SVE-2016-7121.


The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6 which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors.


Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1) M(6.0) and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack or possibly gain privileges. The Samsung ID is SVE-2016-7120.


Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host resulting in DoS.


Huawei CloudEngine 6800 V100R006C00 CloudEngine 7800 V100R006C00 CloudEngine 8800 V100R006C00 and CloudEngine 12800 V100R006C00 allow remote attackers with specific permission to store massive files to exhaust the shared storage space leading to a DoS condition.


Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE Secospace USG6500 with software V500R001C20 Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory causing a DoS condition.


Huawei USG9520 V300R001C01 USG9560 V300R001C01 and USG9580 V300R001C01 allow unauthenticated attackers to send abnormal DHCP request packets to the affected products to trigger a DoS condition.


In OpenSSL 1.1.0 before 1.1.0c TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.


Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.


An issue was discovered in the IPv6 protocol specification related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in RFC6274 and RFC7739. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement RFC6946. That is employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed unnecessarily. We note that unfortunately even nodes that already implement RFC6946 can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) RFC7872 some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B reporting an MTU smaller than 1280 this will trigger the generation of IPv6 atomic fragments from that moment on (as required by RFC2460). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message) these packets will be dropped since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent the aforementioned routers will themselves be the ones dropping their own traffic.


Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function `minimatch(path pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.


An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.


MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application making a DoS attack feasible with very little bandwidth.


An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg'AllowArbitraryServer'=true. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


In the XSS Protection API module before 1.0.12 in Apache Sling the method XSS.getValidXML() uses an insecure SAX parser to validate the input string which allows for XXE attacks in all scripts which use this method to validate user input potentially allowing an attacker to read sensitive data on the filesystem perform same-site-request-forgery (SSRF) port-scanning behind the firewall or DoS the application.


An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS


H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi mruby proxy redirect or reproxy.


QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.


The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames which could allow remote attackers to overwrite arbitrary files via a symlink attack.


An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) table for an active partition which prevents the system from booting even though the MBR is not malformed. NOTE: it has been debated as to whether or not this issue poses a security vulnerability since administrative privileges would be required and other DoS attacks are possible with such privileges.


The secure script in LogWatch before 2.6-2 allows attackers to prevent LogWatch from detecting malicious activity via certain strings in the secure file that are later used as part of a regular expression which causes the parser to crash aka \logwatch log processing regular expression DoS.\


Multiple

SQL

injection

vulnerabilities

in

vBulletin

and

earlier

allow

remote

attackers

to

execute

arbitrary

SQL

commands

via

the

announcement

parameter

to

announcement.php

the

threadforumid

or

criteria

parameters

to

thread.php

userid

parameter

to

user.php

the

calendarcustomfieldid

calendarid

moderatorid

holidayid

calendarmoderatorid

or

parameters

to

admincalendar.php

the

cronid

parameter

to

cronlog.php

parameter

to

email.php

parameter

to

help.php

the

limitnumber

or

limitstart

parameter

to

user.php

the

usertitleid

or

ids

parameters

to

usertitle.php

parameter

to

language.php

parameter

to

phrase.php

dostyleid

parameter

to

template.php

threadforumid

parameter

to

thread.php

or

usertools.php.


Apache Tomcat 4.0.3 when running on Windows allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9 which leaks the pathname in an error message as demonstrated by lpt9.xtp using Nikto.


Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp.


NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000 NT and XP does not verify user execution permissions for 16-bit executable files which allows local users to bypass the loader and execute arbitrary programs.


htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5 such as (1) a request with a .pl or .java extension or (2) a request containing a large number of periods which causes htcgibin.exe to leak the pathname in an error message.


MsmMask.exe in MondoSearch 4.4 allows remote attackers to obtain the source code of scripts via the mask parameter.


OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4 which allows physically proximate attackers to change the PIN.


Acidcat CMS 3.4.1 does not properly restrict access to (1) default_mail_aspemail.asp (2) default_mail_cdosys.asp or (3) default_mail_jmail.asp which allows remote attackers to bypass restrictions and relay email messages with modified From FromName and To fields.


Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.


A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch 2.6.38-test3.patch and 2.6.37.4-test14.patch. A bad bounds check in arch_get_unmapped_area_topdown triggered by programs doing an mmap after a MAP_GROWSDOWN mmap will create an infinite loop condition without releasing the VM semaphore eventually leading to a system crash.


tog-Pegasus has a package hash collision DoS vulnerability


A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.


A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.


A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS


The FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to gain sensitive information via a cd command that contains an MS-DOS device name which reveals the installation path in an error message.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cc4 triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509 triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d7d triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578dd8 triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3 triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.


SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the words_exact parameter.


SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.


SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.


CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.


SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.


SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum array parameter.


SQL injection vulnerability in todos.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter a different vector than CVE-2008-3306.


There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state causing the parser to use CPU resources disproportionate to the request size.


There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS.


There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Bluetooth DoS.


There is an Integer Underflow (Wrap or Wraparound) Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS of Samgr.


It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.


An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1. Improper URL processing may lead to data exfiltration.


An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1 macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history.


An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6. A local user may be able to view sensitive user information.


An issue existed in the selection of video file by Mail. The issue was fixed by selecting the latest version of a video. This issue is fixed in iOS 13.4 and iPadOS 13.4. Cropped videos may not be shared properly via Mail.


An issue existed in the handling of incoming calls. The issue was addressed with additional state checks. This issue is fixed in iOS 14.2 and iPadOS 14.2. A user may answer two calls simultaneously without indication they have answered a second call.


An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.


The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video data may be shared via iCloud links even if Live Photo is disabled in the Share Sheet carousel.


The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.1 and iPadOS 13.1 tvOS 13. A malicious application may be able to determine kernel memory layout.


The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13.1 and iPadOS 13.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.


This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may be able to gain elevated privileges.


The issue was addressed with improved UI handling. This issue is fixed in iOS 14.5 and iPadOS 14.5. A local user may be able to view sensitive information in the app switcher.


This issue was addressed with improved checks. This issue is fixed in iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to heap corruption.


The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restricted files.


This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. A person with physical access to an iOS device may be able to access notes from the lock screen.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted audio file may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. Processing a maliciously crafted dfont file may lead to arbitrary code execution.


This issue was addressed with improved handling of file metadata. This issue is fixed in iOS 15.2 and iPadOS 15.2. A user in a FaceTime call may unexpectedly leak sensitive user information through Live Photos metadata.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing a maliciously crafted image may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted file may lead to arbitrary code execution.


The issue was addressed with improved permissions logic. This issue is fixed in iOS 15 and iPadOS 15. An attacker with physical access to a device may be able to see private contact information.


The issue was addressed with improved permissions logic. This issue is fixed in watchOS 8 macOS Big Sur 11.6 iOS 15 and iPadOS 15. A malicious application may be able to bypass Privacy preferences.


This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina iTunes 12.12 for Windows tvOS 15 iOS 15 and iPadOS 15 watchOS 8. Processing a maliciously crafted image may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1 tvOS 15.1 watchOS 8.1 macOS Big Sur 11.6.1. A local attacker may be able to elevate their privileges.


This issue was addressed with improved checks. This issue is fixed in iOS 14.6 and iPadOS 14.6. A malicious application may disclose restricted memory.


This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15. A local attacker may be able to cause unexpected application termination or arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted image may lead to disclosure of user information.


This issue was addressed with improved checks. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. A malicious application may be able to modify protected parts of the file system.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A local attacker may be able to elevate their privileges.


This issue was addressed with improved checks. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. Processing a maliciously crafted image may lead to arbitrary code execution.


This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15 watchOS 8. A local attacker may be able to read sensitive information.


The issue was addressed with improved permissions logic. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access contacts from the lock screen.


This issue was addressed with improved checks. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1 iOS 15.1 and iPadOS 15.1 macOS Monterey 12.0.1. A local attacker may be able to cause unexpected application termination or arbitrary code execution.


The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata without needing permission to access photos.


This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 15 and iPadOS 15. A 3D model constructed to look like the enrolled user may be able to authenticate via Face ID.


This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may disclose memory contents.


This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions.


The issue was addressed with additional permissions checks. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3 watchOS 8.5. A malicious application may be able to read other applications' settings.


This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt.


This issue was addressed with improved checks. This issue is fixed in iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3. A user may send audio and video in a FaceTime call without knowing that they have done so.


This issue was addressed with improved checks. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3 watchOS 8.5. A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions.


This issue was addressed with improved checks. This issue is fixed in watchOS 8.5 iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt.


The issue was addressed with improved permissions logic. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3 watchOS 8.5. A malicious application may be able to bypass certain Privacy preferences.


This issue was addressed with improved checks. This issue is fixed in iOS 13.5 and iPadOS 13.5. Users removed from an iMessage conversation may still be able to alter state.


The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website permissions to a site they didn't intend to.


The issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0 Safari 14.0 iOS 14.0 and iPadOS 14.0. Visiting a malicious website may lead to address bar spoofing.


The issue was addressed with improved handling of icon caches. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.0 and iPadOS 14.0. A malicious app may be able to determine the existence of files on the computer.


This issue was addressed with improved checks. This issue is fixed in iOS 14.0 and iPadOS 14.0 watchOS 7.0. The screen lock may not engage after the specified time period.


This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions.


The issue was addressed with improved handling of icon caches. This issue is fixed in iOS 14.0 and iPadOS 14.0. A malicious application may be able to identify what other applications a user has installed.


This issue was addressed with improved checks. This issue is fixed in watchOS 6.3 iOS 12.5 iOS 14.3 and iPadOS 14.3 watchOS 7.2. Unauthorized code execution may lead to an authentication policy violation.


This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 watchOS 6.2. An application may be able to use an SSH client provided by private frameworks.


This issue was addressed with improved checks. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. An application may be able to use arbitrary entitlements.


The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.


The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompletion.


This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be able to alter state.


In JetBrains Hub before 2021.1.13415 a DoS via user information is possible.


In JetBrains Hub before 2021.1.13956 an unprivileged user could perform DoS.


In JetBrains IntelliJ IDEA before 2021.1 DoS was possible because of unbounded resource allocation.


In JetBrains TeamCity before 2020.2.2 TeamCity server DoS was possible via server integration.


The Linux kernel before 2.2.19 does not have unregister calls for (1) CPUID and (2) MSR drivers which could cause a DoS (crash) by unloading and reloading the drivers.


A logic issue existed in the handling of document loads. This issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. Previewing an html file attached to a note may unexpectedly contact remote servers.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. A local user may be able to modify protected parts of the file system.


A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3 iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5. Processing maliciously crafted web content may lead to universal cross site scripting.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5 tvOS 14.5. A local user may be able to create or modify privileged files.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 macOS Big Sur 11.3. Muting a CallKit call while ringing may not result in mute being enabled.


A logic issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. In certain situations the baseband would fail to enable integrity and ciphering protection.


A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism.


A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.1 watchOS 8.3 iOS 15.2 and iPadOS 15.2 macOS Big Sur 11.6.2. A malicious application may be able to bypass certain Privacy preferences.


A logic issue was addressed with improved state management. This issue is fixed in tvOS 15 watchOS 8 iOS 15 and iPadOS 15. A sandboxed process may be able to circumvent sandbox restrictions.


A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Safari 14.1.1 macOS Big Sur 11.4 watchOS 7.5. A malicious application may be able to leak sensitive user information.


A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1 iOS 15.1 and iPadOS 15.1 watchOS 8.1 tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. A malicious application may be able to modify protected parts of the file system.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2 tvOS 15.1 watchOS 8.1 macOS Monterey 12.0.1. A malicious application may be able to access information about a user's contacts.


A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1 watchOS 8.3 iOS 15.2 and iPadOS 15.2 tvOS 15.2. User traffic might unexpectedly be leaked to a proxy server despite PAC configurations.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visible onscreen.


A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1 iOS 14.8 and iPadOS 14.8 tvOS 15 Safari 15 watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.


A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Safari 14.1.1 macOS Big Sur 11.4 watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.


A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1 iOS 15.1 and iPadOS 15.1 watchOS 8.1 tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.6 and iPadOS 14.6. A device may accept invalid activation results.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.8 and iPadOS 14.8. A remote attacker may be able to cause arbitrary code execution.


A logic issue was addressed with improved validation. This issue is fixed in watchOS 8 iOS 15 and iPadOS 15. An application with microphone permission may unexpectedly access microphone input during a FaceTime call.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2 tvOS 15.1 watchOS 8.1 macOS Monterey 12.0.1. A malicious application may be able to read user's gameplay data.


A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Safari 14.1.1 macOS Big Sur 11.4 watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.


A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An attacker in a privileged network position may be able to leak sensitive user information.


A logic issue was addressed with improved state management. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 watchOS 8.5 macOS Monterey 12.3. A malicious application may be able to elevate privileges.


A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3 iOS 15.3 and iPadOS 15.3 watchOS 8.4 macOS Monterey 12.2. A malicious application may be able to gain root privileges.


A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4 macOS Monterey 12.3. An application may be able to gain elevated privileges.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4. A malicious website may be able to access information about the user and their devices.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0 tvOS 14.0 watchOS 7.0. A malicious application may be able to leak sensitive user information.


A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 macOS Catalina 10.15.6 tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.


A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4. An attacker in a privileged network position may be able to intercept Bluetooth traffic.


A logic issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5. An application may be able to gain elevated privileges.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6 Safari 13.1.2. An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6 Safari 13.1.2. A malicious attacker may cause Safari to suggest a password for the wrong domain.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5. A remote attacker may be able to modify the file system.


A logic issue was addressed with improved validation. This issue is fixed in watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0 macOS Big Sur 11.0.1. A malicious application may be able to elevate privileges.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2 tvOS 14.2 watchOS 7.1. A malicious application may be able to determine kernel memory layout.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.0 and iPadOS 14.0 macOS Catalina 10.15.7 tvOS 14.0 watchOS 7.0. A malicious application may be able to access restricted files.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. A sandboxed process may be able to circumvent sandbox restrictions.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. Some websites may not have appeared in Safari Preferences.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.3 and iPadOS 14.3. An enterprise application installation prompt may display the wrong domain.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 14.2 and iPadOS 14.2 iCloud for Windows 11.5 tvOS 14.2 iTunes 12.11 for Windows. A local user may be able to read arbitrary files.


A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1 iOS 14.2 and iPadOS 14.2. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. A file URL may be incorrectly processed.


A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4 watchOS 6.2. A person with physical access to a locked iOS device may be able to respond to messages even when replies are disabled.


A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4. A maliciously crafted page may interfere with other web contexts.


A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.


The NetIQ Identity Manager communication channel in versions prior to 4.7 is susceptible to a DoS attack.


Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier and possibly 2.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) dodosmail_header_file or (2) dodosmail_footer_file parameters.


mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local the user should open a specially crafted file. The fixed version is: 1.2.1.


Multiple unknown vulnerabilities in PROMS 0.11 allow \non-authorized users\ to (1) view or modify the project member list or (2) modify the todos list.


A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15 iOS 13.1 and iPadOS 13.1 tvOS 13 watchOS 6 iOS 13. A local app may be able to read a persistent account identifier.


A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2 macOS Catalina 10.15.1 tvOS 13.2 watchOS 6.1. An application may be able to read restricted memory.


A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4 watchOS 7.3 iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.


A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4. A local user may be able to write arbitrary files.


A validation issue was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5 watchOS 7.4 macOS Big Sur 11.3. A malicious application may be able to leak sensitive user information.


A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to read restricted memory.


A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations which may lead to a denial of server (DoS).


A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos


A vulnerability was found in Radare2 in versions prior to 5.6.2 5.6.0 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS.


A vulnerability was found in Radare2 in version 5.3.1. Improper input validation when reading a crafted LE binary can lead to resource exhaustion and DoS.


A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server all with a Content-Length header value that exceeds the actual byte count of the request body.


It was found in Undertow before 1.3.28 that with non-clean TCP close the Websocket server gets into infinite loop on every IO thread effectively causing DoS.


It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks or read files from the server where EAP is deployed.


Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.


Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuff.php instead of going through the login screen.


naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation and is directly used by the exec function.


A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled \deviceName\ value is passed directly to the \doSystemCmd\ function.


Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted \action/umountUSBPartition\ request. This occurs because the \formSetUSBPartitionUmount\ function executes the \doSystemCmd\ function with untrusted input.


Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).


An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7) AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9) and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the \formsetUsbUnload\ function executes a dosystemCmd function with untrusted input.


An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call causing OS command injection.


A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8 watchOS 6.2.8 Safari 13.1.2 iTunes 12.10.8 for Windows iCloud for Windows 11.3 iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection.


A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit GradleReleaseApiAction#doStaging MavenReleaseApiAction#doStaging and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build perform release staging for Gradle and Maven projects and promote previously staged builds respectively.


MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.


A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (Cross-Site Request Forgery). This requires the victim to be tricked into clicking a malicious link or submitting a malicious form. A successful exploit allows the attacker to perform arbitrary actions with the privileges of the victim e.g. creating and modifying user accounts changing system configuration settings and cause DoS conditions. Note: For Bosch PRAESIDEO 4.31 and newer and Bosch PRAESENSA in all versions the confidentiality impact is considered low because user credentials are not shown in the web interface.


J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS).


The Naranjas Con Tocados (aka com.NaranjasConTocados.com) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel freeing device memory in driver probe failure will result in double free issue in power module.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


In all Android releases from CAF using the Linux kernel a double free vulnerability exists in a display driver.


The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures which allows remote attackers to discover full pathnames via a crafted web site.


The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.


The drag-and-drop implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux and before 21.0.1180.60 on Windows and Chrome Frame allows user-assisted remote attackers to bypass intended file access restrictions via a crafted web site.


Unspecified \drag-and-drop vulnerability\ in Opera Web Browser before 8.50 on Windows allows \unintentional file uploads.\


The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.


The

drag-and-drop-multiple-file-upload-contact-form-7

plugin

before

for

WordPress

allows

Unrestricted

File

Upload

and

remote

code

execution

by

setting

to

php%

and

uploading

a

.php%

file.


Detcon Sitewatch Gateway all versions without cellular an attacker can edit settings on the device using a specially crafted URL.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Stand are affected running software versions prior to 7.0(3)F3(5).


A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated remote attacker to gain elevated privileges on an affected vManage device. The vulnerability is due to a failure to properly authorize certain user actions in the device configuration. An attacker could exploit this vulnerability by logging in to the vManage Web UI and sending crafted HTTP requests to vManage. A successful exploit could allow attackers to gain elevated privileges and make changes to the configuration that they would not normally be authorized to make.


Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access.


An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario an attacker could host a website that is used to attempt to exploit the vulnerability aka 'Microsoft Edge Elevation of Privilege Vulnerability'.


A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can elevate privileges to gain full control of the system even if they are specifically denied access to perform certain actions. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D80 on SRX Series.


An elevation of privilege vulnerability exists in Microsoft Exchange Server aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.


A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095


Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow local users to interact with the On-Access Scan Messages - Threat Alert Window with elevated privileges via running McAfee Tray with elevated privileges.


ASP.NET Core 1.0. 1.1 and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests aka \ASP.NET Core Elevation Of Privilege Vulnerability\. This CVE is unique from CVE-2018-0784.


ASP.NET Core 1.0. 1.1 and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests aka \ASP.NET Core Elevation Of Privilege Vulnerability\.


ASP.NET Core 1.0. 1.1 and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates aka \ASP.NET Core Elevation Of Privilege Vulnerability\. This CVE is unique from CVE-2018-0808.


Microsoft Windows 10 Gold 1511 and 1607 does not properly enforce permissions which allows local users to obtain Administrator access via a crafted DLL aka \Windows Permissions Enforcement Elevation of Privilege Vulnerability.\


Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23283 CVE-2022-23287.


Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24540.


Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24482.


Windows ALPC Elevation of Privilege Vulnerability.


Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23287 CVE-2022-24505.


Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23283 CVE-2022-24505.


.NET and Visual Studio Elevation of Privilege Vulnerability


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16959 CVE-2020-16960 CVE-2020-16961 CVE-2020-16962 CVE-2020-16964.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16959 CVE-2020-16960 CVE-2020-16961 CVE-2020-16963 CVE-2020-16964.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16960 CVE-2020-16961 CVE-2020-16962 CVE-2020-16963 CVE-2020-16964.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16959 CVE-2020-16960 CVE-2020-16961 CVE-2020-16962 CVE-2020-16963.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16959 CVE-2020-16961 CVE-2020-16962 CVE-2020-16963 CVE-2020-16964.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958 CVE-2020-16959 CVE-2020-16960 CVE-2020-16962 CVE-2020-16963 CVE-2020-16964.


Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16959 CVE-2020-16960 CVE-2020-16961 CVE-2020-16962 CVE-2020-16963 CVE-2020-16964.


Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability


Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability.


Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17103 CVE-2020-17136.


Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17103 CVE-2020-17134.


Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17134 CVE-2020-17136.


Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29135 CVE-2022-29150.


Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29135 CVE-2022-29151.


Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-29150 CVE-2022-29151.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36955 CVE-2021-36963.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36963 CVE-2021-38633.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36955 CVE-2021-38633.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43207.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-43226.


Windows Common Log File System Driver Elevation of Privilege Vulnerability


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40443 CVE-2021-40467.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40466 CVE-2021-40467.


Windows Common Log File System Driver Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40443 CVE-2021-40466.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24521.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24481.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21981.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21897.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-22000.


Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21916.


Microsoft Defender for IoT Elevation of Privilege Vulnerability.


Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278 CVE-2021-42282 CVE-2021-42287.


Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282 CVE-2021-42287 CVE-2021-42291.


Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278 CVE-2021-42282 CVE-2021-42291.


Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278 CVE-2021-42287 CVE-2021-42291.


Active Directory Domain Services Elevation of Privilege Vulnerability.


Microsoft DWM Core Library Elevation of Privilege Vulnerability


Windows DWM Core Library Elevation of Privilege Vulnerability.


Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23291.


Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23288.


Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21896 CVE-2022-21902.


Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21852 CVE-2022-21902.


Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21852 CVE-2022-21896.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36931.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26436.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36928.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-36930.


Microsoft

Edge

(Chromium-based)

Elevation

of

Privilege

Vulnerability.

This

CVE

ID

is

unique

from


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23263.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23262.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21970.


Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21954.


Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs aka \Microsoft Edge Elevation of Privilege Vulnerability.\


Microsoft Edge allows remote attackers to gain privileges via a crafted web site aka \Microsoft Browser Elevation of Privilege Vulnerability.\


Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors aka \Microsoft Edge Elevation of Privilege Vulnerability \ a different vulnerability than CVE-2016-0158.


Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors aka \Microsoft Edge Elevation of Privilege Vulnerability \ a different vulnerability than CVE-2016-0161.


Microsoft Edge in Microsoft Windows 10 1511 1607 1703 and Windows Server 2016 allows an attacker to escape from the AppContainer sandbox aka \Microsoft Edge Elevation of Privilege Vulnerability\. This CVE ID is unique from CVE-2017-8642.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0960 CVE-2019-1017.


An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape aka 'Windows NTFS Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1086 CVE-2019-1088.


An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages aka 'Microsoft Outlook Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when a ASP.NET Core web application created using vulnerable project templates fails to properly sanitize web requests aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393 CVE-2019-1394 CVE-2019-1395 CVE-2019-1396 CVE-2019-1408.


An elevation of privilege exists in the p2pimsvc service where an attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.To exploit this vulnerability an attacker would first have to log on to the system aka 'Microsoft Windows p2pimsvc Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1164.


An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges aka 'Windows 10 Update Assistant Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1362.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007 CVE-2019-1022 CVE-2019-1026 CVE-2019-1027 CVE-2019-1028.


An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1175 CVE-2019-1177 CVE-2019-1178 CVE-2019-1179 CVE-2019-1180 CVE-2019-1184 CVE-2019-1186.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393 CVE-2019-1394 CVE-2019-1396 CVE-2019-1408 CVE-2019-1434.


An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215 CVE-2019-1278 CVE-2019-1303.


An elevation of privilege vulnerability exists due to a stack corruption in Windows Subsystem for Linux aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Dynamics On-Premise v9 aka 'Dynamics On-Premise Elevation of Privilege Vulnerability'.


In SkSwizzler::onSetSampleX of SkSwizzler.cpp there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-117838472.


An elevation of privilege vulnerability exists when umpo.dll of the Power Service improperly handles a Registry Restore Key function aka 'Windows Power Service Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory aka 'Windows Network Connectivity Assistant Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers aka 'Windows Printer Service Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that the ssdpsrv.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1174 CVE-2019-1175 CVE-2019-1177 CVE-2019-1179 CVE-2019-1180 CVE-2019-1184 CVE-2019-1186.


An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1336.


An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the vulnerability an attacker would require unprivileged execution on the victim system aka 'Windows Installer Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1159.


An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407 CVE-2019-1433 CVE-2019-1435 CVE-2019-1437.


An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management resulting in access to system files.To exploit this vulnerability an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges. aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation in a secured location aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1422 CVE-2019-1423.


An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts aka 'Windows Shell Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory aka 'DirectX Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system aka 'Windows ALPC Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1269.


An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges aka 'Microsoft Windows Setup Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.To exploit the vulnerability an attacker would first have to log on to the system aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320 CVE-2019-1322.


An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1483.


An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability an attacker would first have to log on to the system aka 'Microsoft Defender Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253 CVE-2019-1278 CVE-2019-1303.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1174 CVE-2019-1175 CVE-2019-1177 CVE-2019-1178 CVE-2019-1180 CVE-2019-1184 CVE-2019-1186.


An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files aka 'Visual Studio Elevation of Privilege Vulnerability'.


A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated local attacker to gain elevated privileges on an affected device. The vulnerability is due to an incorrect authorization check of user accounts and their associated Group ID (GID). An attacker could exploit this vulnerability by taking advantage of a logic error that will permit the use of higher privileged commands than what is necessarily assigned. A successful exploit could allow an attacker to execute commands with elevated privileges on the underlying Linux shell of an affected device. Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22) 8.2(3) and 8.3(2). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory.An attacker who successfully exploited the vulnerability could execute code with elevated permissions.To exploit the vulnerability a locally authenticated attacker could run a specially crafted application.The security update addresses the vulnerability by ensuring the Windows kernel image properly handles objects in memory. aka 'Windows Image Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows Audio Service when a malformed parameter is processed aka 'Windows Audio Service Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when Windows improperly handles authentication requests aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320 CVE-2019-1340.


A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory aka 'Windows Kernel Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer aka 'Visual Studio Code Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393 CVE-2019-1394 CVE-2019-1395 CVE-2019-1396 CVE-2019-1434.


An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files aka 'Git for Visual Studio Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007 CVE-2019-1021 CVE-2019-1022 CVE-2019-1026 CVE-2019-1027.


An elevation of privilege vulnerability exists in Microsoft Exchange Server aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1476.


An elevation of privilege exists in SyncController.dll aka 'Microsoft Windows Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1087 CVE-2019-1088.


An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file with local privileges is vulnerable to symbolic link and hard link attacks aka 'Microsoft Compatibility Appraiser Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability an attacker would first have to gain execution on the victim system aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215 CVE-2019-1253 CVE-2019-1278.


An elevation of privilege vulnerability exists in the way that the wcmsvc.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1174 CVE-2019-1175 CVE-2019-1177 CVE-2019-1178 CVE-2019-1179 CVE-2019-1184 CVE-2019-1186.


An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'.


A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated local attacker to gain elevated privileges as the root user on an affected device. The vulnerability is due to extraneous subcommand options present for a specific CLI command within the local-mgmt context. An attacker could exploit this vulnerability by authenticating to an affected device entering the local-mgmt context and issuing a specific CLI command and submitting user input. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid user credentials for the device.


An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407 CVE-2019-1433 CVE-2019-1437 CVE-2019-1438.


An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions aka 'Visual Studio Elevation of Privilege Vulnerability'.


A vulnerability in the CLI of Cisco SD-WAN Solution could allow an authenticated local attacker to elevate lower-level privileges to the root user on an affected device. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. A successful exploit could allow the attacker to make configuration changes to the system as the root user.


An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations aka 'Windows Data Sharing Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1383 CVE-2019-1417.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1285.


An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL with Local Service privilege is vulnerable to race planting a customized DLL.An attacker who successfully exploited this vulnerability could potentially elevate privilege to SYSTEM.The update addresses this vulnerability by requiring SYSTEM privileges for a certain DLL. aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1074.


An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. aka 'Microsoft IIS Server Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1174 CVE-2019-1177 CVE-2019-1178 CVE-2019-1179 CVE-2019-1180 CVE-2019-1184 CVE-2019-1186.


A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker's privilege level. To exploit this vulnerability the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393 CVE-2019-1395 CVE-2019-1396 CVE-2019-1408 CVE-2019-1434.


A vulnerability in Cisco IOS XE Software could allow an authenticated local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected commands. An exploit could allow the attacker to gain root privileges on the affected device.


An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges aka 'Microsoft Windows Update Client Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1323.


An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173 CVE-2019-1174 CVE-2019-1175 CVE-2019-1177 CVE-2019-1178 CVE-2019-1179 CVE-2019-1180 CVE-2019-1186.


An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory aka 'DirectX Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1021 CVE-2019-1022 CVE-2019-1026 CVE-2019-1027 CVE-2019-1028.


An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1315 CVE-2019-1339.


An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.


Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. For more information about these vulnerabilities see the Details section of this security advisory.


An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication aka 'Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1041.


An elevation of privilege vulnerability exists when Windows improperly handles authentication requests aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1322 CVE-2019-1340.


An elevation of privilege vulnerability exists in the way that the dnsrslvr.dll handles objects in memory aka 'Windows dnsrlvr.dll Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow in the way the library caches tokens aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system aka 'Windows ALPC Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1272.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1086 CVE-2019-1087.


An elevation of privilege exists in hdAudio.sys which may lead to an out of band write aka 'Windows Media Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339 CVE-2019-1342.


A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated local attacker to access sensitive data that could be used to elevate their privileges to administrator. The vulnerability is due to improper implementation of filesystem permissions. An attacker could exploit this vulnerability by logging in to the CLI of an affected device accessing a specific file and leveraging this information to authenticate to the NX-API server. A successful exploit could allow an attacker to make configuration changes as administrator. Note: NX-API is disabled by default. Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).


An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1420 CVE-2019-1422.


An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0960 CVE-2019-1014.


An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1174 CVE-2019-1175 CVE-2019-1177 CVE-2019-1178 CVE-2019-1179 CVE-2019-1180 CVE-2019-1184 CVE-2019-1186.


An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations aka '.NET Framework Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007 CVE-2019-1021 CVE-2019-1022 CVE-2019-1027 CVE-2019-1028.


An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407 CVE-2019-1433 CVE-2019-1435 CVE-2019-1438.


An elevation of privilege vulnerability exists in Microsoft SharePoint aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1329.


An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory aka 'Windows Kernel Elevation of Privilege Vulnerability'.


An elevation of privilege exists in Windows Audio Service aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1007 CVE-2019-1021 CVE-2019-1026 CVE-2019-1027 CVE-2019-1028.


An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations aka 'Task Scheduler Elevation of Privilege Vulnerability'.


An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations aka 'Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability'.