Threats Tagged 'cwe-843'

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

A heap buffer overflow vulnerability exists in LibreOffice Calc when importing tracked changes from spreadsheet documents that reuse the same change identifier for different change types. This causes a type confusion where the importer treats one change object as a larger type, leading to out-of-bounds memory writes. The issue affects versions 25.8 and 26.2. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation information is currently available.

LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

Access of resource using incompatible type ('type confusion') in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

The Helpfulcrowd Product Reviews WordPress plugin up to version 1.2.9 contains an authorization bypass vulnerability due to improper token validation using PHP loose comparison. This allows unauthenticated attackers to modify plugin settings by sending a crafted request to a REST endpoint with a JSON boolean true token, bypassing authentication checks and enabling arbitrary configuration changes.