| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally. |
| Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally. |
| A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code. |
| Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. |
| Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally. |
| Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file. |
| Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network. |
| Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. |
| A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server. |
| Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. |
| EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability. |
| Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. |
| Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
| FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure. |
| FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A malicious RD Gateway can send pre-authentication consent or service messages, causing the client to read twice the buffer size, leaking heap memory or crashing. |
| Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0. |
