Vulnerabilidades

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Un uso después de liberar (use-after-free) en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente.

Una lectura fuera de límites en Microsoft Office Excel permite a un atacante no autorizado divulgar información localmente.

Un desbordamiento de búfer basado en montículo (heap) en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Una lectura fuera de límites en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente.

Una lectura fuera de límites en Microsoft Office Excel permite a un atacante no autorizado divulgar información localmente.

Un desbordamiento de búfer basado en montículo (heap) en Microsoft Graphics Component permite a un atacante no autorizado ejecutar código a través de una red.

Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request.

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en Somonator Terms Dictionary terms-dictionary permite XSS Reflejado. Este problema afecta a Terms Dictionary: desde n/a hasta menor o igual que 1.5.1.

Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the…

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint

Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint

Un uso después de liberar (use-after-free) en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente.

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

Un uso después de liberar (use-after-free) en Microsoft Office Excel permite a un atacante no autorizado ejecutar código localmente.

Una lectura fuera de límites en Microsoft Office Excel permite a un atacante no autorizado divulgar información localmente.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.