Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other th…
-
Unscored —
An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead…
-
Unscored —
An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function r…
-
High 7.8
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged att…
-
Medium 5.5
Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from th…
-
Medium 6.1
Windows UPnP Service Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges.…
-
Critical 9.9
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application…
-
Medium 5.4
TLS Information Disclosure Vulnerability
<p>A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this vulnerability could obtain information to further compromise a users's encrypted transmission channel.</p> <p>To exploit…
-
High 7.6
Windows Media Audio Decoder Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.</p> <p>There are multiple ways an attacker could ex…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If …
-
Medium 6.6
Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges on the victim system.</p> …
-
Medium 4.4
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploit…
-
Medium 4.4
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this …
-
High 8.5
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Share…
-
High 7.8
Windows Storage Services Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p> <p>To exploit the vulnerability, an attacker w…
-
Medium 5.4
Microsoft Office SharePoint XSS Vulnerability
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially…
-
High 7.8
Windows InstallService Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows InstallService improperly handles memory.</p> <p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially craf…
-
High 8.9
Microsoft SharePoint Server Tampering Vulnerability
<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p> <p>To exploit the vulnerability, an attacker…
-
High 7.6
Windows Media Audio Decoder Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.</p> <p>There are multiple ways an attacker could ex…
-
Medium 5.4
Microsoft Office SharePoint XSS Vulnerability
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially…
-
Medium 6.1
Windows Start-Up Application Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>There are multiple ways an attacker coul…
-
High 7.9
Microsoft COM for Windows Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system.</p> <p>To exploit the vulnerab…
-
Medium 6.3
Microsoft Office SharePoint XSS Vulnerability
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially…
-
High 7.8
Windows Function Discovery Service Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>To exploit the vu…
-
High 7.3
Windows CloudExperienceHost Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when Microsoft Windows CloudExperienceHost fails to check COM objects. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system.</p> <p>To exploit the vulner…
-
High 8.6
Microsoft SharePoint Server Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page…
-
High 8.6
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Share…
-
Medium 6.3
Microsoft SharePoint Server Tampering Vulnerability
<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data.</p> <p>To exploit the vulnerability, an attacker…
-
High 8.6
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Share…
-
High 7.4
Microsoft Office SharePoint XSS Vulnerability
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially…
-
High 7.8
Windows Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in the way that fdSSDP.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>To exploit the vulnerability, a locally authe…
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security conte…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If …
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If …
-
High 7.3
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install pro…
-
High 8.4
GDI+ Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could t…
-
High 7.0
DirectX Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or d…
-
Medium 5.5
Windows Runtime Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.</p> <p>An attacker could exploit this v…
-
High 7.8
Windows Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when Windows improperly handles objects in memory. To exploit the vulnerability an attacker would have to convince a user to run a specially crafted application.</p> <p>An attacker who successfully exploited thi…
-
Medium 5.5
Windows GDI Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p…