Threats Tagged 'cwe-749'

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.

CVE-2026-44107 is a high-severity vulnerability in the Phoenix Contact CHARX SEC-3150 charging controller. It allows an unauthenticated attacker to trigger a reboot of the device via Modbus TCP when the Modbus service is enabled. This results in a denial-of-service (DoS) condition by disrupting the charging controller's operation.

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker-controlled Node.js code. This issue is fixed in versions 3.2.5, 4.1.8, and 5.0.0-beta.

CVE-2026-45489 is a medium severity spoofing vulnerability in Microsoft Edge (Chromium-based) involving an exposed dangerous method or function. The vulnerability allows an attacker to potentially spoof content, impacting confidentiality but not integrity or availability. An official fix is available from Microsoft.