Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

microsoft

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

microsoft

Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

microsoft

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized read access to a subset of Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).

oracle

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

dnnsoftware

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

dnnsoftware

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

dnnsoftware

Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

microsoft

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

microsoft

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

microsoft

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

microsoft

Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.

microsoft

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

microsoft

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

microsoft

Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

microsoft

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

microsoft

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

microsoft

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

microsoft

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

microsoft