Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilte...
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network....
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network....
Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network....
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network....
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network....
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network....
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network....
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network....
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network....
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network....
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network....
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network....
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network....
Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network....
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network....
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network....
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the vic...
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation ...
Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network....
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network....
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network....