CVEs

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Online Certificate Status Protocol (OCSP) allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally.

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an a

Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.