Edwardzpeng

Name of the Vulnerable Software and Affected Versions: Microsoft Office (affected versions not specified) Description: A free of memory issue not on the heap in Microsoft Office may allow an unauthorized attacker to execute code locally. The vulnerability allows remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Plus (affected versions not specified) Description: The software contains an issue that allows an unauthorized attacker to perform spoofing over a network, potentially leading to exposure of sensitive information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified) Description: An out-of-bounds read issue exists in Microsoft Office Excel. This allows an unauthorized attacker to execute code locally. The vulnerability enables remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Kernel (affected versions not specified) Description: A vulnerability allows attackers to obtain sensitive information and affect the system. The Windows Kernel generates error messages containing sensitive information, potentially allowing a locally authorized attacker to disclose information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified) Description: A heap-based buffer overflow exists in Microsoft Office Excel. This issue allows a remote attacker to execute arbitrary code on the affected system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. The vulnerability enables remote attackers to execute arbitrary code and affect the system.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Word (affected versions not specified) Description: A buffer over-read issue exists in Microsoft Office Word, potentially allowing a local attacker to disclose information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified) Description: Access of a resource using an incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. The vulnerability allows remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A use-after-free vulnerability exists in Microsoft Office Excel. This allows an unauthorized attacker to execute code locally. The vulnerability enables remote attackers to execute arbitrary code and impact the system.

Name of the Vulnerable Software and Affected Versions: Windows Connected Devices Platform Service (affected versions not specified) Description: The issue is related to a use after free condition in the Windows Connected Devices Platform Service, which allows an unauthorized attacker to execute code over a network. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel (affected versions not specified) Description: The issue is related to a use after free condition in Microsoft Office Excel, which allows an unauthorized attacker to execute code locally. This could potentially lead to malicious activities on the affected system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Streaming Service (affected versions not specified) Description: The issue concerns sensitive data storage in improperly locked memory, allowing an unauthorized attacker to deny service over a network. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient input sanitization in Microsoft SharePoint Server, allowing remote attackers to execute arbitrary code and affect the system.

The issue is related to the use of an unreliable path search in Microsoft SharePoint Server, allowing a remote attacker to execute arbitrary code using specially crafted files. This can affect the system.

The issue is related to an improper memory access problem in shared memory APIs. This can be triggered by a user through a network API, potentially leading to denial of service and data tampering.

The issue allows a user to set the logging location to an arbitrary file. If this file exists, logs are appended to the file. A successful exploit might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Name of the Vulnerable Software and Affected Versions: OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0 Description: The issue is related to the Murano service's MuranoPL extension to the YAQL language, which fails to sanitize the supplied environment. This could lead to potential leakage of sensitive service account information. Recommendations: For OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0, consider disabling the Murano service or fully removing it from all OpenStack deployments as a temporary workaround until a patch is available.

The issue concerns the default email address for the initial admin user, which is set to `admin[@]mycompany[.]com`. This could potentially affect password reset functionality if the domain `mycompany.com` is registered in the future. The estimated number of potentially affected devices is not specified.

The issue is related to incorrect restriction of a directory path with limited access in the JumpServer security audit system. This can allow a remote attacker to gain unauthorized access to protected information and modify the contents of arbitrary files in the system. A directory traversal flaw can be exploited using a provided URL, such as `https://jumpserver-ip/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd`, to access and retrieve file contents. A similar method to modify file content is also present.

The issue is related to the exposure of the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled, users are not affected. Users not using local authentication are also not affected.