| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally. |
| Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Release of invalid pointer or reference in Windows COM allows an authorized attacker to elevate privileges locally. |
| Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network. |
| Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. |
| An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.
A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Windows Smart Card allows an authorized attacker to disclose information with a physical attack. |
| Stack-based buffer overflow in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. |
| Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
| Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| Heap-based buffer overflow in Windows Management Instrumentation allows an unauthorized attacker to execute code locally. |
| Inadequate encryption strength in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network. |
| Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes. |
