Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 8898 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-0089 2 Microsoft, Nvidia 10 Windows, Cloud Gaming, Geforce and 7 more 2024-11-21 7.8 High
NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed. A successful exploit of this vulnerability might lead to code execution, information disclosure, or data tampering.
CVE-2023-7047 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 4.4 Medium
Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL data sources.
CVE-2023-6753 2 Lfprojects, Microsoft 2 Mlflow, Windows 2024-11-21 8.8 High
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
CVE-2023-5847 3 Linux, Microsoft, Tenable 4 Linux Kernel, Windows, Nessus and 1 more 2024-11-21 6.7 Medium
Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts.
CVE-2023-5808 2 Hitachi, Microsoft 2 Vantara Hitachi Network Attached Storage, Windows 2024-11-21 7.6 High
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.
CVE-2023-5766 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 9.8 Critical
A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a specially crafted TCP packet.
CVE-2023-5765 2 Devolutions, Microsoft 2 Remote Desktop Manager, Windows 2024-11-21 9.8 Critical
Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass permissions via data source switching.
CVE-2023-5727 2 Microsoft, Mozilla 4 Windows, Firefox, Firefox Esr and 1 more 2024-11-21 6.5 Medium
The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
CVE-2023-5257 2 Microsoft, Whitehsbg 2 Windows, Jndiexploit 2024-11-21 3.5 Low
A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. VDB-240866 is the identifier assigned to this vulnerability.
CVE-2023-5042 2 Acronis, Microsoft 2 Cyber Protect Home Office, Windows 2024-11-21 7.5 High
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713.
CVE-2023-51750 2 Microsoft, Scalefusion 2 Windows, Scalefusion 2024-11-21 4.6 Medium
ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."
CVE-2023-50443 2 Microsoft, Primx 2 Windows, Cryhod 2024-11-21 4.6 Medium
Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which disks are opened.
CVE-2023-4996 2 Microsoft, Netskope 2 Windows, Netskope 2024-11-21 6.6 Medium
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service. 
CVE-2023-4973 2 Creativeitem, Microsoft 2 Academy Lms, Windows 2024-11-21 3.5 Low
A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-4891 2 Lenovo, Microsoft 2 View Driver, Windows 2024-11-21 5.5 Medium
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.
CVE-2023-4770 2 4d, Microsoft 3 4d, Server, Windows 2024-11-21 6.5 Medium
An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the installation path, causing an arbitrary code execution.
CVE-2023-4759 4 Apple, Eclipse, Microsoft and 1 more 4 Macos, Jgit, Windows and 1 more 2024-11-21 8.8 High
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r. The JGit maintainers would like to thank RyotaK for finding and reporting this issue.
CVE-2023-4688 4 Acronis, Apple, Linux and 1 more 4 Agent, Macos, Linux Kernel and 1 more 2024-11-21 5.5 Medium
Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433.
CVE-2023-4601 2 Microsoft, Ni 2 Windows, System Configuration 2024-11-21 8.1 High
A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response. This affects NI System Configuration 2023 Q3 and all previous versions.
CVE-2023-4595 2 Microsoft, Seattlelab 2 Windows, Slmail 2024-11-21 7.5 High
An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.