Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+4)
Windows Hyper-V Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows Network Address Translation (NAT) Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2016,
Microsoft Windows Server 2019
... (+11)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows Bluetooth Driver Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 24h2
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+4)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+4)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
NTFS Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
Azure Stack Hub Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Stack Hub
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+12)
Windows Kernel Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2016,
Microsoft Windows Server 2019,
Microsoft Windows 10 1507
... (+10)
Azure Connected Machine Agent Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Connected Machine Agent
Microsoft OfficePlus Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Officeplus
Windows TCP/IP Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+13)
Windows DNS Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+4)
Windows Kerberos Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2012
... (+10)
If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack.
In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.
In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL).
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an unauthenticated attacker with physical access to the phone to conduct an argument injection attack, due to insufficient parameter san...
symphonycms <=2.7.10 is vulnerable to Cross Site Scripting (XSS) in the Comment component for articles.
AFFECTED_PRODUCTS:
Symphony-Cms Symphony Cms
A Cross Site Scripting (XSS) vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing note.
AFFECTED_PRODUCTS:
Symphony-Cms Symphony Cms
An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle attackers.
The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.
AFFECTED_PRODUCTS:
Mitel Mivoice Mx One,
Mitel Mivoice Mx One
Improper key usage control in AMD Secure Processor
(ASP) may allow an attacker with local access who has gained arbitrary code
execution privilege in ASPÂ to
extract ASP cryptographic keys, potentially resulting in loss of
confidentiality and integrity.
Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service.
AFFECTED_PRODUCTS:
AMD Uprof,
AMD Uprof,
AMD Uprof
Incomplete system memory cleanup in SEV firmware could
allow a privileged attacker to corrupt guest private memory, potentially
resulting in a loss of data integrity.
Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
AFFECTED_PRODUCTS:
AMD Uprof,
AMD Uprof,
AMD Uprof
A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
AFFECTED_PRODUCTS:
AMD Uprof,
AMD Uprof,
AMD Uprof
Insufficient
validation of the Input Output Control (IOCTL) input buffer in AMD μProf may
allow an authenticated attacker to cause an out-of-bounds write, potentially
causing a Windows® OS crash, resulting in denial of service.
AFFECTED_PRODUCTS:
AMD Uprof,
AMD Uprof,
AMD Uprof
Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.
AFFECTED_PRODUCTS:
Arm Trusted Firmware A,
AMD Trusted Firmware A
Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input selection" command, potentially resulting in a loss of integrity and/or availability.
Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.
AFFECTED_PRODUCTS:
AMD Radeon Software,
AMD Radeon Software
Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure.
Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF)   to modify the PCIe® lane count and speed, potentially leading to a loss of availability.
Improper re-initialization of IOMMU during the DRTM event
may permit an untrusted platform configuration to persist, allowing an attacker
to read or modify hypervisor memory, potentially resulting in loss of
confidentiality, integrity, and availability.
AFFECTED_PRODUCTS:
AMD Epyc 72f3 Firmware,
AMD Epyc 7313 Firmware,
AMD Epyc 7313p Firmware
... (+62)
IOMMU improperly handles certain special address
ranges with invalid device table entries (DTEs), which may allow an attacker
with privileges and a compromised Hypervisor to
induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a
loss of guest integrity.
AFFECTED_PRODUCTS:
AMD Epyc 72f3 Firmware,
AMD Epyc 7313 Firmware,
AMD Epyc 7313p Firmware
... (+62)
A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow
an attacker with ring0 privileges and access to the
BIOS menu or UEFI shell to modify the communications buffer potentially
resulting in arbitrary code execution.
AFFECTED_PRODUCTS:
AMD Epyc 7001 Firmware,
AMD Epyc 7232p Firmware,
AMD Epyc 7251 Firmware
... (+102)
Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality.
An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) to send a malformed message, potentially resulting in a denial of service.
A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug information leakage.
An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to SRAM, potentially resulting in data corruption or denial of service.
AFFECTED_PRODUCTS:
AMD Radeon Software,
AMD Radeon Software
An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially resulting in loss of data integrity.