Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Windows Kernel Security Feature Bypass Vulnerability

Windows Geolocation Service Information Disclosure Vulnerability

Windows NTFS Elevation of Privilege Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.

Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.

Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Azure Data Studio Elevation of Privilege Vulnerability

Proxy Driver Spoofing Vulnerability

Microsoft Intune Linux Agent Elevation of Privilege Vulnerability

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Microsoft SharePoint Server Information Disclosure Vulnerability

Windows Group Policy Security Feature Bypass Vulnerability

Active Directory Domain Services Information Disclosure Vulnerability

Azure DevOps Server Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.

Windows Collaborative Translation Framework Elevation of Privilege Vulnerability

NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client's secure context.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access.

Windows Registry Elevation of Privilege Vulnerability

Azure Machine Learning Information Disclosure Vulnerability

Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Remote Desktop Client Remote Code Execution Vulnerability

Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.

MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."

Windows Kernel Elevation of Privilege Vulnerability

Azure Service Fabric Container Elevation of Privilege Vulnerability

Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability