Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698132 source statements · aliases may refer to the same vulnerabilityExcelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
cve-program ·
Vendor product: excelize
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
cve-program ·
Vendor product: SimpleHelp
WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: post-title-marquee-scroll
WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wp-post-author
Cisco NX-OS Software Python Sandbox Escape Vulnerability
cve-program ·
Vendor product: Cisco NX-OS Software
Cisco Finesse Server-Side Request Forgery Vulnerability
cve-program ·
Vendor product: Cisco Finesse
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: everest-forms
WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: disable-remove-google-fonts
WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: forminator
Infinite Loop in Telerik Document Processing XLS Import
cve-program ·
Vendor product: Telerik Document Processing Libraries
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
cve-program ·
Vendor product: Cisco Secure Email · Vendor product: Cisco Secure Email and Web Manager
Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S
cve-program ·
Vendor product: AOS-Switch (AOS-S)
Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S
cve-program ·
Vendor product: AOS-Switch (AOS-S)
Unauthenticated Sensitive Information Disclosure in AOS-S
cve-program ·
Vendor product: AOS-Switch (AOS-S)
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
cve-program ·
Vendor product: excelize
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
cve-program ·
Vendor product: excelize
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attack…
cve-program ·
Vendor product: Python
Inefficient Regular Expression Complexity in node-fetch/node-fetch
cve-program ·
Vendor product: node-fetch/node-fetch
A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from thi…
cve-program ·
Vendor product: kernel
A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem
cve-program ·
Vendor product: kernel
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
cve-program ·
Vendor product: excelize
Hydra logging configuration permits unsafe callable resolution
cve-program ·
Vendor product: hydra
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Apache Impala: Impala Executor Webserver Auth Bypass
cve-program ·
Vendor product: Apache Impala
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
cve-program ·
Vendor product: xstream
XStream is vulnerable to a Remote Command Execution attack
cve-program ·
Vendor product: xstream
Apache Impala: Path traversal executes JARs outside trusted paths
cve-program ·
Vendor product: Apache Impala
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
cve-program ·
Vendor product: xstream
Apache Impala: Stored XSS in Impala query plans
cve-program ·
Vendor product: Apache Impala
XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur…
cve-program ·
Vendor product: n/a
Server-Side Forgery Request can be activated unmarshalling with XStream
cve-program ·
Vendor product: xstream
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.