Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

Microsoft SharePoint Server Information Disclosure Vulnerability

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.

Windows Kernel Elevation of Privilege Vulnerability

Active Directory Domain Services Information Disclosure Vulnerability

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.

Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.

Windows Registry Elevation of Privilege Vulnerability

Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 HF (Hot Fix) may allow a privileged user to potentially enable escalation of privilege via local access.

Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access.

Azure Service Connector Security Feature Bypass Vulnerability

Azure Machine Learning Information Disclosure Vulnerability

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.

All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may allow a user to access arbitrary physical memory, leading to an escalation of privileges.

Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.

Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.

Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Remote Desktop Client Remote Code Execution Vulnerability

During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on some Windows 10 PCs where a user with local privileges could run arbitrary code with administrator level privileges.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network access.

Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Windows Backup Service Elevation of Privilege Vulnerability

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Azure CycleCloud Elevation of Privilege Vulnerability

Microsoft Intune for Android Mobile Application Management Tampering Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Defender for IoT Elevation of Privilege Vulnerability

Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."

Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.

Microsoft Intune Linux Agent Elevation of Privilege Vulnerability

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."

Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Video Control Remote Code Execution Vulnerability."