Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
697874 source statements · aliases may refer to the same vulnerabilityXSS in Bootstrap title attribute for Tooltip and Popover
cve-program ·
Vendor product: Bootstrap
BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses
osv · GHSA-5chw-87w3-j9cv
crates.io: bip322
WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: holler-box
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.
cve-program ·
Vendor product: Ironic
Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
cve-program ·
https://repo.hex.pm: cowlib · https://github.com: ninenines/cowlib
Authenticated argument injection in NIOS command line leading to privilege escalation
cve-program ·
Vendor product: NIOS
HP Sure Click Kernel Buffer Overflow
cve-program ·
Vendor product: HP Sure Click Enterprise · Vendor product: HP Wolf Security for Business · Vendor product: HP Wolf Pro Security
Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
cve-program ·
Vendor product: Vault · Vendor product: Vault Enterprise
Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
cve-program ·
Vendor product: Vault · Vendor product: Vault Enterprise
IBM DataPower Gateway Buffer Overflow
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Improper Verification of Cryptographic Signature
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Buffer Overflow
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
mk-oracle: Local privilege escalation via malicious Oracle Instant Client
cve-program ·
Vendor product: Checkmk
IBM DataPower Gateway Improper Verification of Cryptographic Signature
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Out-of-bounds Write
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Buffer Overflow
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Out-of-bounds Write
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Out-of-bounds Write
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Out-of-bounds Write
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
IBM DataPower Gateway Improper Authorization
cve-program ·
Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to prop…
cve-program ·
Vendor product: Fabric OS
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting …
cve-program ·
Vendor product: Fabric OS
An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking un…
cve-program ·
Vendor product: Fabric OS
A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allo…
cve-program ·
Vendor product: Fabric OS
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will r…
cve-program ·
Vendor product: Fabric OS
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration downloa…
cve-program ·
Vendor product: Fabric OS
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and exe…
cve-program ·
Vendor product: Fabric OS
An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames ac…
cve-program ·
Vendor product: Fabric OS
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and…
cve-program ·
Vendor product: Fabric OS
A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that c…
cve-program ·
Vendor product: Fabric OS
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system c…
cve-program ·
Vendor product: Fabric OS
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user wit…
cve-program ·
Vendor product: Fabric OS
Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise
cve-program ·
Vendor product: Splunk Enterprise
Stored Cross-Site Scripting in SQLView KRIS
cve-program ·
Vendor product: SQLView KRIS
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.