Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction. Scope is changed.

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.

Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.