IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product.
IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials.
Microsoft Business Central Information Disclosure Vulnerability
Azure Site Recovery Elevation of Privilege Vulnerability
ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.
Windows Group Policy Elevation of Privilege Vulnerability
Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
Skype for Business Information Disclosure Vulnerability
Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
Azure Entra ID Elevation of Privilege Vulnerability
Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
Microsoft SharePoint Server Information Disclosure Vulnerability
Windows Group Policy Security Feature Bypass Vulnerability
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Azure DevOps Server Elevation of Privilege Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
Azure Networking Elevation of Privilege Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.