Total
1372 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-3224 | 1 Docker | 1 Desktop | 2025-05-10 | 7.8 High |
| A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\ProgramData\Docker\config with high privileges. However, this directory often does not exist by default, and C:\ProgramData\ allows normal users to create new directories. By creating a malicious Docker\config folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege. | ||||
| CVE-2022-31256 | 1 Opensuse | 1 Factory | 2025-05-09 | 7.7 High |
| A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1. | ||||
| CVE-2022-32905 | 1 Apple | 1 Macos | 2025-05-06 | 7.8 High |
| This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges. | ||||
| CVE-2023-2939 | 2 Google, Microsoft | 2 Chrome, Windows | 2025-05-05 | 7.8 High |
| Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium) | ||||
| CVE-2024-46744 | 1 Linux | 1 Linux Kernel | 2025-05-04 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- V2: fix spelling mistake. | ||||
| CVE-2024-20656 | 1 Microsoft | 4 Visual Studio, Visual Studio 2017, Visual Studio 2019 and 1 more | 2025-05-03 | 7.8 High |
| Visual Studio Elevation of Privilege Vulnerability | ||||
| CVE-2024-21397 | 1 Microsoft | 1 Azure File Sync | 2025-05-03 | 5.3 Medium |
| Microsoft Azure File Sync Elevation of Privilege Vulnerability | ||||
| CVE-2024-21329 | 1 Microsoft | 1 Azure Connected Machine Agent | 2025-05-03 | 7.3 High |
| Azure Connected Machine Agent Elevation of Privilege Vulnerability | ||||
| CVE-2024-28916 | 1 Microsoft | 1 Xbox Gaming Services | 2025-05-03 | 8.8 High |
| Xbox Gaming Services Elevation of Privilege Vulnerability | ||||
| CVE-2024-21432 | 1 Microsoft | 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more | 2025-05-03 | 7 High |
| Windows Update Stack Elevation of Privilege Vulnerability | ||||
| CVE-2024-26199 | 1 Microsoft | 1 365 Apps | 2025-05-03 | 7.8 High |
| Microsoft Office Elevation of Privilege Vulnerability | ||||
| CVE-2024-29989 | 1 Microsoft | 2 Azure Monitor, Azure Monitor Agent | 2025-05-03 | 8.4 High |
| Azure Monitor Agent Elevation of Privilege Vulnerability | ||||
| CVE-2024-28907 | 1 Microsoft | 1 Windows Server 2022 23h2 | 2025-05-03 | 7.8 High |
| Microsoft Brokering File System Elevation of Privilege Vulnerability | ||||
| CVE-2024-26216 | 1 Microsoft | 6 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 3 more | 2025-05-03 | 7.3 High |
| Windows File Server Resource Management Service Elevation of Privilege Vulnerability | ||||
| CVE-2024-26158 | 1 Microsoft | 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more | 2025-05-03 | 7.8 High |
| Microsoft Install Service Elevation of Privilege Vulnerability | ||||
| CVE-2024-21447 | 1 Microsoft | 7 Windows 10 21h2, Windows 10 22h2, Windows 11 21h2 and 4 more | 2025-05-03 | 7.8 High |
| Windows Authentication Elevation of Privilege Vulnerability | ||||
| CVE-2024-30033 | 1 Microsoft | 4 Windows 10 21h2, Windows 10 22h2, Windows 11 21h2 and 1 more | 2025-05-03 | 7 High |
| Windows Search Service Elevation of Privilege Vulnerability | ||||
| CVE-2024-26238 | 1 Microsoft | 2 Windows 10 21h2, Windows 10 22h2 | 2025-05-03 | 7.8 High |
| Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability | ||||
| CVE-2024-30060 | 1 Microsoft | 1 Azure Monitor Agent | 2025-05-03 | 7.8 High |
| Azure Monitor Agent Elevation of Privilege Vulnerability | ||||
| CVE-2019-13689 | 1 Google | 2 Chrome, Chrome Os | 2025-05-02 | 7.8 High |
| Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Critical) | ||||