| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise. |
| Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally. |
| Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally. |
| Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
| Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network. |
| Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. |
| Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network. |
| Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
| Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. |
| Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. |
| A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability. |
| Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally. |
| Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
