| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker with low‑privileged access to compromise the confidentiality, integrity, and availability of the software. Successful exploitation allows the attacker to cross an authentication and authorization boundary beyond their originally assigned access, resulting in a scope change. |
| Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
| Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
| Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network. |
| Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
| Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content. |
| Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally. |
| Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. |
| Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network. |
| Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
| Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network. |
| Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section. |
