ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. Advisory content revised: zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components …4 linked entries across history · in Security Follow evidence and connection reasons
  2. Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression Advisory content revised: Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with …4 linked entries across history · in Security Follow evidence and connection reasons
  3. Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug Advisory content revised: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that …4 linked entries across history · in Security Follow evidence and connection reasons
  4. Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass Advisory content revised: Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A…4 linked entries across history · in Security Follow evidence and connection reasons
  5. .NET Framework Remote Code Execution Vulnerability Advisory content revised: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.4 linked entries across history · in Security Follow evidence and connection reasons
  6. Microsoft Teams: Pop out calls into a new browser window Roadmap entry4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  7. Microsoft Purview: Permissions audit log improvements Roadmap entry4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  8. Microsoft 365 app: Inventory - Update Repair Roadmap entry4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  9. zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size Advisory content revised: zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before …3 linked entries across history · in Security Follow evidence and connection reasons
  10. Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion Advisory content revised: devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a…3 linked entries across history · in Security Follow evidence and connection reasons
  11. Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval Advisory content revised: Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to une…3 linked entries across history · in Security Follow evidence and connection reasons
  12. Devalue before 5.6.3 Denial of Service via Sparse Array Serialization Advisory content revised: The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not…3 linked entries across history · in Security Follow evidence and connection reasons
  13. Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records Advisory content revised: The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses c…3 linked entries across history · in Security Follow evidence and connection reasons
  14. No limit on the size of a decompressed SSH packet Newly collected advisory3 linked entries across history · in Security Follow evidence and connection reasons
  15. Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
  16. .NET Framework Remote Code Execution Vulnerability Advisory content revised: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.3 linked entries across history · in Security Follow evidence and connection reasons
  17. .NET Remote Code Execution Vulnerability Advisory content revised: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.3 linked entries across history · in Security Follow evidence and connection reasons
  18. Exchange Online limits Guidance changed3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  19. Windows deprecated features Guidance changed3 linked entries across history · in Windows Follow evidence and connection reasons
  20. OpenAI: Elevated errors affecting the Microsoft 365 connector Ongoing incident3 linked entries across history · in Other vendors Follow evidence and connection reasons
  21. Microsoft Teams: Automatic recording and transcription choices align with admin policies Now rolling out3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  22. Microsoft Teams: Add alternate text to images shared from OneDrive and SharePoint Now rolling out3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  23. Memory exhaustion from an unchecked SSH packet length Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  24. Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check Source marks advisory rejected: No standard GStreamer pipeline element invokes the vulnerable parser API. Exploitation would require a third-party application to call it with attacker-controlled H.266 DCI data.2 linked entries across history · in Security Follow evidence and connection reasons
  25. Client `Handler` callbacks run for channels the client never opened Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  26. UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  27. Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  28. Relative path traversal vulnerability in openEuler iSulad on Linux. Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  29. Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  30. TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 12:08 UTC · 274 of 275 readable · 272 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.