| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1. |
| External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue. |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.
This issue affects Apache Kylin: from 4.0.4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue. |
| A flaw was found in curl. When curl is built with the GnuTLS library, a blocked transmission during communication with a malicious WebSocket server can trigger an out-of-bounds memory read. A malicious server can exploit this flaw to expose sensitive data from neighboring memory buffers or crash the client, leading to information disclosure or a Denial of Service (DoS). |
| A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in an application using pooled connections can cause subsequent transfers to inadvertently reuse an existing connection. This behavior causes outbound network traffic to be transmitted through the wrong source address, potentially routing requests through an unintended network interface. |
| Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
| Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
| Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally. |
| HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks. |
| Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. |
| Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally. |
| Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. |
| Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. |
