| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5. |
| Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions:
Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5. |
| Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type. |
| Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally. |
| Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally. |
| Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. |
| Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. |
| Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) |
| Microsoft Office Elevation of Privilege Vulnerability |
| WmsRepair Service Elevation of Privilege Vulnerability |
| Remote Desktop Client Remote Code Execution Vulnerability |
| Microsoft SharePoint Elevation of Privilege Vulnerability |
| Microsoft System Center Elevation of Privilege Vulnerability |
| Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network. |
| Visual C++ Redistributable Installer Elevation of Privilege Vulnerability |
| Windows Remote Desktop Services Tampering Vulnerability |
| Microsoft SharePoint Elevation of Privilege Vulnerability |
| Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low) |
| Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
