Jeudi 15 octobre 2026

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024 · Microsoft 365 apps

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

mayerbalintdev GYM-One

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.

Red Hat Fuse 7 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

Grafana Enterprise · Grafana OSS

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.

Hewlett Packard Enterprise HPE NonStop XABroker

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

Hewlett Packard Enterprise HPE NonStop ODBC/MX Server

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.

Hewlett Packard Enterprise HPE NonStop ODBC/MX Services

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.

sensiolabs symfony

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough. This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.

Sparx Systems Enterprise Architect

Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.

Hewlett Packard Enterprise HPE NonStop SQL/MX UDR SERVER

A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.

PeaZip

Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

Hewlett Packard Enterprise HPE NonStop SQL/MX SQLCAT

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.

Hewlett Packard Enterprise HPE NonStop ANSI SQLUTIL

A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.

Hewlett Packard Enterprise HPE NonStop SQL/MX Executor

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.

Hewlett Packard Enterprise HPE NonStop HTTP WEBSERVER

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

Hewlett Packard Enterprise HPE NonStop Debug Utilities

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

Hewlett Packard Enterprise HPE NonStop Inspect Subsystem

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

Hewlett Packard Enterprise HPE NonStop OCAX

A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.

Hewlett Packard Enterprise HPE NonStop NDSREST

A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.

Hewlett Packard Enterprise HPE NonStop Python 3.x

A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

Mitsubishi Electric Corporation GENESIS · Mitsubishi Electric Iconics Digital Solutions GENESIS · Mitsubishi Electric Corporation GENESIS64 · Mitsubishi Electric Iconics Digital Solutions GENESIS64

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

SUSE steve

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

Hewlett Packard Enterprise HPE NonStop TNS/X Native Inspect

A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

Hewlett Packard Enterprise HPE NonStop SOAP 4.0

A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.

Hewlett Packard Enterprise HPE NonStop EXPAND

A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.

Hewlett Packard Enterprise HPE NonStop TELSERV

A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.

Hewlett Packard Enterprise HPE NonStop QIOMON

A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.

Hewlett Packard Enterprise HPE NonStop CIPSAM

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.

Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES

A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.

Hewlett Packard Enterprise HPE NonStop SNMP Trap Multiplexer

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption

Ellucian WebAdvisor

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.

renovatebot renovate · mend renovate-ce · mend renovate-ee-server · mend renovate-ee-worker

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

renovatebot renovate · mend renovate-ce · mend renovate-ee-server · mend renovate-ee-worker

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

renovatebot renovate · mend renovate-ce · mend renovate-ee-server · mend renovate-ee-worker

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.