The internet is broken right now.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Release of invalid pointer or reference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Other

Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Memory safety

Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Memory safety Server

Uncontrolled resource consumption in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to deny service over a network.

Other OS & kernel

Missing release of memory after effective lifetime in Windows Kerberos allows an unauthorized attacker to deny service over a network.

Other OS & kernel

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Denial of service

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Other

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Denial of service

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.

Injection Device

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Auth & access Web app

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Auth & access Web app

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Memory safety

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Other

Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running.

Code execution OS & kernel

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.

Injection Device

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Injection Web app

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Injection Web app

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Injection Web app

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Injection Web app

Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

Auth & access OS & kernel

Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Other Server

Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.

Other Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

Memory safety OS & kernel

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction.

Injection Web app

No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network.

Other OS & kernel

Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network.

Memory safety OS & kernel

A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Memory safety Device

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

Memory safety

Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.

Memory safety

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Denial of service Library

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel