| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0. |
| Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally. |
| Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability. |
| Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally. |
| Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally. |
| Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity. |
| Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity. |
| Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory. |
| Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
| Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network. |
| Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network. |
| Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network. |
| Heap-based buffer overflow in Windows NetBIOS allows an unauthorized attacker to elevate privileges over a network. |
| Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network. |
| Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
