| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests. |
| The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts. |
| Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally. |
| Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store. |
| Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store. |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. |
| Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| Improper certificate validation in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
| Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally. |
