Microsoft Bing Search Spoofing Vulnerability

Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)

IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 284564.

Chromium: CVE-2021-30619 UI Spoofing in Autofill

Chromium: CVE-2021-30617 Policy bypass in Blink

Chromium: CVE-2021-30621 UI Spoofing in Autofill

Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing support for an integrity check. An unauthenticated attacker could leverage this vulnerability to modify content in a certified PDF without invalidating the certification. Exploitation of this issue requires user interaction in that a victim must open the tampered file.

Windows SmartScreen Spoofing Vulnerability

Windows DCOM Server Security Feature Bypass

Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

Windows Themes Spoofing Vulnerability

Azure Stack Hub Spoofing Vulnerability

Windows Nearby Sharing Spoofing Vulnerability

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204341.

Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Office Spoofing Vulnerability

IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 188898.

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Microsoft Power Platform Connector Spoofing Vulnerability

Windows MSHTML Platform Security Feature Bypass Vulnerability

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.

The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.

Windows MSHTML Platform Security Feature Bypass Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

NTLM Hash Disclosure Spoofing Vulnerability

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability

NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability