| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. |
| Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. |
| Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with malicious 'k' values that are echoed unsanitized, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. |
| TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19. |
| Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. |
| Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Portable Device File System Driver allows an authorized attacker to elevate privileges locally. |
| Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
| Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally. |
| Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally. |
| Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. |
