| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
| Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network. |
| Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Use after free in Winsock allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Incorrect permission assignment for critical resource in Windows Brokering File System allows an authorized attacker to elevate privileges locally. |
| SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _ic=Y) with a crafted value, causing SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter, which is insufficient on MySQL/MariaDB because those dialects also honor backslash escapes, letting a backslash-terminated payload break out of the string literal and turn the WHERE clause into a tautology. The default Derby datasource and PostgreSQL are not affected because they do not interpret backslash as an escape character in this context. Users are recommended to upgrade to version 24.09.08, which fixes this issue. |
