2023

SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest

Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to

Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to a

Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an inva

Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to rea

Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds

Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-b

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 an

An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0

An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4

A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack at

An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability

Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10,

An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allo

ASP.NET Security Feature Bypass Vulnerability

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM versi

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability

Windows Hyper-V Elevation of Privilege Vulnerability

Windows Distributed File System (DFS) Remote Code Execution Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Microsoft Remote Registry Service Remote Code Execution Vulnerability

Microsoft Windows Defender Elevation of Privilege Vulnerability

Microsoft Office Security Feature Bypass Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Windows Hyper-V Elevation of Privilege Vulnerability

Windows Hyper-V Elevation of Privilege Vulnerability

Windows Hyper-V Information Disclosure Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Information Disclosure Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft Remote Registry Service Remote Code Execution Vulnerability

Windows HMAC Key Derivation Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability

Windows NTFS Information Disclosure Vulnerability

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Windows Compressed Folder Remote Code Execution Vulnerability

Windows Deployment Services Denial of Service Vulnerability

Windows Search Service Elevation of Privilege Vulnerability

Windows User Interface Application Core Remote Code Execution Vulnerability

DHCP Server Service Denial of Service Vulnerability

Azure CLI REST Command Information Disclosure Vulnerability

Microsoft Exchange Server Spoofing Vulnerability