| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected. |
| A vulnerability was determined in ToolJet up to 3.20.256-lts/3.21.93-beta. The impacted element is the function activateUserWithPassword of the file server/src/modules/onboarding/util.service.ts of the component Onboarding Signup Endpoint. Executing a manipulation of the argument email can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.21.94-beta is sufficient to resolve this issue. This patch is called af8f17a745621ae418f1743440f63d315e8b8643. The affected component should be upgraded. The vendor was contacted early about this disclosure. |
| In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
| In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
| In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network. |
| Use after free in Windows Link Layer Topology Discovery Protocol allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
| Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network. |
| Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
