Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.