| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations. |
| ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1. |
| Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network. |
| Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. |
| Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally. |
| Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network. |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
| Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
