| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack. |
| Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows Blind SQL Injection.This issue affects wpDataTables: from n/a through 7.4. |
| Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption. |
| 歸類為 JSONCPP Open Source 之問題 |
| Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
The memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS). |
| Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host. |
| Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
When the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes. |
| UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.
This issue affects iSulad: through 2.1.6.
If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read. |
| Use after free in Windows Management Services allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
