Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695938 source statements · aliases may refer to the same vulnerabilityImproper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.
cve-program ·
Vendor product: Intel(R) Processors
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in…
cve-program ·
Vendor product: Spring Framework
cups: ownership of /var/log/cups allows the lp user to create files as root
cve-program ·
Vendor product: SUSE Linux Enterprise Server 11-SP4-LTSS · Vendor product: SUSE Manager Server 4.0 · Vendor product: SUSE OpenStack Cloud Crowbar 9
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple request…
cve-program ·
Vendor product: Apache Tomcat
RFD Protection Bypass via jsessionid
cve-program ·
Vendor product: Spring Framework
Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel Atom(R) Processors
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) VT-d products
CA certificate check bypass with X509_V_FLAG_X509_STRICT
cve-program ·
Vendor product: OpenSSL
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
cve-program ·
Vendor product: QT Library
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
cve-program ·
Vendor product: minimist
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
cve-program ·
Vendor product: n/a
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial …
cve-program ·
Vendor product: n/a
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to dat…
cve-program ·
Vendor product: python-pip
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
cve-program ·
Vendor product: Spring Framework
A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied t…
cve-program ·
Vendor product: Red Hat Enterprise Linux
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use …
cve-program ·
Vendor product: kernel
libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can resu…
cve-program ·
Vendor product: n/a
Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
cve-program ·
Vendor product: Apache Commons Compress
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that…
cve-program ·
Vendor product: n/a
The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.
cve-program ·
Vendor product: n/a
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
cve-program ·
Vendor product: n/a
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.