The internet is broken right now.

Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.

Denial of service

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

Memory safety Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

Memory safety Server

Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Disclosure Server

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed.

Auth & access Web app

Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Disclosure Server

Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.

Disclosure

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

XSS

Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Disclosure Server

Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.

Other OS & kernel

IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.

Injection

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.

Other Network gear

Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

Injection Network gear

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Memory safety

Integer underflow (wrap or wraparound) in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel

Uncontrolled resource consumption in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Other OS & kernel

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

XSS Server

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or analyze call is required. One specific attack chain has been reported, but other attack chains may exist. An application is affected when it uses ImageMagick for Active Storage image processing through config.active_storage.variant_processor = :mini_magick, runs ImageMagick under a security policy that does not already deny the involved coders, and allows uploads from untrusted users. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Code execution Web app

Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network.

Memory safety OS & kernel

The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full chain depends on the plugin's outbound validateToken() call to Payever's service; the unauthenticated hard-coded-credential identity overwrite (CWE-862/CWE-798) is independently exploitable.

Code execution Web app

Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.

Other OS & kernel

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Memory safety

Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction.

Auth & access Web app

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Auth & access Server

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.

Memory safety Server

IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.

Injection OS & kernel

Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

Disclosure

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

Auth & access

Authorization bypass through user-controlled key in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Auth & access Server

Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.

Memory safety OS & kernel

Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel

Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

Memory safety Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Memory safety Server

Relative path traversal in Windows Deployment Services allows an unauthorized attacker to disclose information over a network.

Disclosure OS & kernel

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66.

Injection Web app