Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699878 source statements · aliases may refer to the same vulnerabilityDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. An unauthenticated attacker with remote access could …
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability. An unauthen…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this v…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
cve-program ·
Vendor product: n/a
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. An unauthenticated attacker with remote access could …
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. An unauthenticated attacker with remo…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
cve-program ·
Vendor product: cyberpanel
SiYuan before v3.8.2 Path Traversal via removeRiffDeck
cve-program ·
Vendor product: siyuan
Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
cve-program ·
Vendor product: siyuan
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exp…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress
cve-program ·
https://repo1.maven.org/maven2/com/github/luben/zstd-jni/: zstd-jni
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially explo…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attac…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms
cve-program ·
Vendor product: AN1044 · Vendor product: AN953 · Vendor product: SW300052
MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load
cve-program ·
Vendor product: MISP
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could pot…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
cve-program ·
Vendor product: utcp
GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
cve-program ·
https://wordpress.org/plugins: GenieWords
Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import
cve-program ·
https://wordpress.org/plugins: Hoo Companion
YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
cve-program ·
https://wordpress.org/plugins: YouTube Embed
MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
cve-program ·
https://wordpress.org/plugins: MDJM Event Management · https://wordpress.org/plugins: Mobile Events Manager
Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
cve-program ·
https://wordpress.org/plugins: Quads Ads Manager for Google AdSense
Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: PC-HELPER Wireless I/O DIO-0404RY-LWF · Vendor product: PC-HELPER Wireless I/O DIO-0404RY-LWF-US
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.