Lokerxx

A heap-based buffer overflow occurs in Windows TPM, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruption issue that happens when a program writes more data to a heap-allocated buffer than it can hold.

An untrusted search path allows an authorized attacker to elevate privileges locally on the system.

A logic issue exists where an application may be able to gain root privileges, which are the highest level of administrative access on the system. This was addressed by implementing improved checks.

A logic issue exists where an application may be able to gain root privileges, which are the highest level of administrative access on the system. This was addressed by implementing improved checks.

A logic issue exists where an application may be able to gain root privileges, which are the highest level of administrative access on the system. This was addressed by implementing improved checks.

A logic issue exists where an application may be able to gain root privileges, which are the highest level of administrative access on the system. This was addressed by implementing improved checks.

The `mod session cookie` module contains an issue where sensitive information may be exposed to an unauthorized actor. Specifically, when the `SessionCookieRemove` directive changes during internal redirects, the session cookie might still be transmitted to a backend server.

Missing authentication checks in the `mod auth digest` module allow an unauthenticated remote client to trigger a denial of service, specifically forced re-authentication. This occurs when Digest authentication is enabled with the `AuthDigestNcCheck` setting and the attacker sends forged Authorization headers.

Improper Privilege Management allows local .htaccess authors to read files using the privileges of the httpd user.

Improper input validation and improper control of code generation allow for code injection. The software exposes the Jolokia JMX-HTTP bridge at the '/api/jolokia/' endpoint. The default access policy permits execution operations on ActiveMQ MBeans, specifically the `BrokerService.addNetworkConnector(String)` and `BrokerService.addConnector(String)` functions. An authenticated attacker can use a crafted discovery URI, such as `masterslave:vm://...,...` or `static:vm://...`, to trigger the `brokerConfig` parameter of the VM transport. This causes the `ResourceXmlApplicationContext` to load a remote Spring XML application context. Since singleton beans are instantiated before configuration validation, arbitrary code can be executed on the broker's JVM via bean factory methods like `Runtime.exec()`.

An issue exists where the HTTP Authentication Header is exposed to unexpected hosts during WebSocket authentication.