| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| App passwords were allowed to bypass password confirmation on sensitive endpoints. |
| A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application. |
| FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown. |
| An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.
To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level. An attacker who successfully exploited this vulnerability could run processes in an elevated context. However, an attacker must first gain access to the local system with the ability to execute a malicious application in order to exploit this vulnerability.
The security update addresses the vulnerability by changing how ndis.sys validates buffer length. |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. |
| Tanium addressed a SQL injection vulnerability in Patch. |
| Tanium addressed a denial of service vulnerability in Tanium Server. |
| Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. |
| Tanium addressed an improper access controls vulnerability in Comply. |
| Tanium addressed an unauthorized code execution vulnerability in Threat Response. |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| Tanium addressed an improper access controls vulnerability in Comply. |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. |
| Tanium addressed an information disclosure vulnerability in Tanium Server. |
| Tanium addressed an insufficient logging vulnerability in Tanium Server. |
| No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. |
