Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally.

Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.

Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.

Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.

Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.

Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.0017 may allow a privileged user to potentially enable escalation of privilege via local access.

Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Remote Desktop Client Remote Code Execution Vulnerability

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Azure DevOps Server Elevation of Privilege Vulnerability

Active Directory Domain Services Information Disclosure Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Windows Kernel Information Disclosure Vulnerability

Windows Group Policy Security Feature Bypass Vulnerability

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Secure Boot Security Feature Bypass Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

Active Directory Domain Services Elevation of Privilege Vulnerability

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Windows Kernel Security Feature Bypass Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows Collaborative Translation Framework Elevation of Privilege Vulnerability

NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client's secure context.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux, which under unique circumstances, could potentially allow a remote, low privileged authenticated attacker to access secure services published a standalone (Unfederated) ArcGIS Server instance.  If successful this compromise would have a high impact on Confidentiality, low impact on integrity and no impact to availability of the software.

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.

WmsRepair Service Elevation of Privilege Vulnerability

Microsoft SharePoint Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Visual Studio Code Remote Extension Elevation of Privilege Vulnerability

Windows Remote Desktop Services Tampering Vulnerability

Microsoft Power Automate Desktop Remote Code Execution Vulnerability

Microsoft Office Elevation of Privilege Vulnerability

Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

Proxy Driver Spoofing Vulnerability