Podatności

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple…

CVSS 7,0 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in…

CVSS 7,0 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…

CVSS 7,0 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic…

CVSS 7,0 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that…

CVSS 7,0 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering…

CVSS 7,0 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user…

CVSS 7,0 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 7,0 · EPSS 0,1 % · rekomendacja wg zapisanej polityki