Windows GDI Information Disclosure Vulnerability

GDI+ Information Disclosure Vulnerability

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.

Windows Authentication Information Disclosure Vulnerability

Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability

Windows Package Library Manager Information Disclosure Vulnerability

iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the system's Personal Key in world-readable %PROGRAMDATA% log files.

Windows Kernel-Mode Driver Information Disclosure Vulnerability

Microsoft Windows Codecs Library Information Disclosure Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Media Foundation Information Disclosure Vulnerability

Windows Bind Filter Driver Information Disclosure Vulnerability

Microsoft Excel Information Disclosure Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

Windows Kernel Information Disclosure Vulnerability

When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119.

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610.

Windows Kernel Information Disclosure Vulnerability

Windows CSC Service Information Disclosure Vulnerability

Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the device could exploit this vulnerability leading to information disclosure.

Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability

Windows Cryptographic Services Information Disclosure Vulnerability

Windows DWM Core Library Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771.

Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message.

Windows Overlay Filter Information Disclosure Vulnerability

Windows Remote Access Connection Manager Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.

Windows DirectX Information Disclosure Vulnerability

Bot Framework SDK Information Disclosure Vulnerability

TPM Device Driver Information Disclosure Vulnerability

Windows Projected File System FS Filter Driver Information Disclosure Vulnerability

Windows (modem.sys) Information Disclosure Vulnerability

Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.

Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 29258.

Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.

Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.