| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3. |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. |
| Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. |
| Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. |
| Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. |
| Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally. |
| Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. |
| ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3. |
| Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network. |
| Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. |
| Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. |
