| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5. |
| Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows SMB Client allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Link-Layer Discovery Protocol (LLDP) allows an unauthorized attacker to deny service over an adjacent network. |
| Untrusted pointer dereference in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network. |
| Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network. |
| Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. |
| Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads. |
| Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
