Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698013 source statements · aliases may refer to the same vulnerabilityA deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the O…
cve-program ·
Vendor product: jackson-databind
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type …
cve-program ·
Vendor product: jackson-databind
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging mo…
cve-program ·
Vendor product: Spring Framework
Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
cve-program ·
Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC
The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the va…
cve-program ·
Vendor product: tcpdump
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.
cve-program ·
Vendor product: Intel(R) Processors
Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
cve-program ·
Vendor product: Intel(R) Processors
Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.
cve-program ·
Vendor product: Intel(R) Processors
Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in…
cve-program ·
Vendor product: Spring Framework
cups: ownership of /var/log/cups allows the lp user to create files as root
cve-program ·
Vendor product: SUSE Linux Enterprise Server 11-SP4-LTSS · Vendor product: SUSE Manager Server 4.0 · Vendor product: SUSE OpenStack Cloud Crowbar 9
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple request…
cve-program ·
Vendor product: Apache Tomcat
RFD Protection Bypass via jsessionid
cve-program ·
Vendor product: Spring Framework
Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel Atom(R) Processors
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) VT-d products
CA certificate check bypass with X509_V_FLAG_X509_STRICT
cve-program ·
Vendor product: OpenSSL
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
cve-program ·
Vendor product: QT Library
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.