Nick Freeman

The issue is caused by insufficient input validation in the network switch of Microsoft Hyper-V operating systems for Windows. It may allow an attacker to cause a denial-of-service of the host operating system from a guest operating system using a specially crafted application.

A denial of service issue exists due to improper handling of DNS responses. This affects the Windows Domain Name System (DNS) DNSAPI.dll.

The issue is related to a remote code execution vulnerability in the Microsoft Windows Domain Name System (DNS) DNSAPI.dll. It occurs when the system fails to properly handle DNS responses. This can be exploited by a remote attacker using specially crafted DNS responses, potentially allowing them to execute arbitrary code or cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue allows remote attackers to execute arbitrary SQL commands via several parameters, including the `picklist name` parameter in the "get picklists" method to "soap/customerportal.php", the `where` parameter in the "get tickets list" method to "soap/customerportal.php", or the `emailaddress` parameter in the "SearchContactsByEmail" method to "soap/vtigerolservice.php". Additionally, remote authenticated users can execute arbitrary SQL commands via the `emailaddress` parameter in the "SearchContactsByEmail" method to "soap/thunderbirdplugin.php".

The issue is related to a stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) that allows remote attackers to execute arbitrary code. This can be achieved by sending a long request to TCP port 4659.

The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers via a .fdx or .fdxt file containing long elements, including `Word`, `Transition`, `Location`, `Extension`, `SceneIntro`, `TimeOfDay`, and `Character`. This can lead to the execution of arbitrary code.

The issue allows remote attackers to read arbitrary files by utilizing a directory traversal technique, specifically by including a .. (backslash dot dot) in the URL.

The issue allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as `onload`. This is due to the extension performing certain operations with chrome privileges.

The issue allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed, as the extension performs certain operations with chrome privileges.