| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations. |
| ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1. |
| Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84. |
| Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
| Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
| Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic. |
| Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
