Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Microsoft Bing Search Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.

User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page.

Power BI Report Server Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsFDF XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5619.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportData XFA function. The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5757.

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Windows Package Library Manager Information Disclosure Vulnerability

Code Integrity Guard Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

BitLocker Security Feature Bypass Vulnerability

The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.

SmartScreen Prompt Security Feature Bypass Vulnerability

Microsoft Bing Search Spoofing Vulnerability

Visual Studio Remote Code Execution Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Internet Shortcut Files Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

BitLocker Security Feature Bypass Vulnerability

Microsoft Office Remote Code Execution Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Windows Remote Desktop Security Feature Bypass Vulnerability

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.