| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a new account that is automatically granted full administrator access. |
| Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network. |
| Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network. |
| Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. |
| Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
| A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs. |
| Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack. |
| Untrusted pointer dereference in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network. |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. |
