| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
| Windows Wi-Fi Driver Remote Code Execution Vulnerability |
| Windows OLE Remote Code Execution Vulnerability |
| Windows Container Manager Service Elevation of Privilege Vulnerability |
| Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability |
| Windows Remote Access Connection Manager Information Disclosure Vulnerability |
| Windows Desktop Bridge Elevation of Privilege Vulnerability |
| Windows Work Folder Service Elevation of Privilege Vulnerability |
| Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability |
| Windows Fax Compose Form Remote Code Execution Vulnerability |
| Windows Fax Compose Form Remote Code Execution Vulnerability |
| Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| Windows Kerberos Elevation of Privilege Vulnerability |
| Windows AppX Package Manager Elevation of Privilege Vulnerability |
| .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| Windows iSCSI Target Service Information Disclosure Vulnerability |
| Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373. |
| When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would
accept in a response, allowing a malicious server to stream an endless series
of headers and eventually cause curl to run out of heap memory. |
| The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI. |
| The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
