Windows Themes Spoofing Vulnerability

Microsoft Accessibility Insights for Web Information Disclosure Vulnerability

Windows NTLM Spoofing Vulnerability

Chromium: CVE-2021-30615 Cross-origin data leak in Navigation

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure.

Adobe Animate version 21.0.5 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Windows MSHTML Platform Spoofing Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

.NET and Visual Studio Information Disclosure Vulnerability

Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

Microsoft Office Spoofing Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft SharePoint Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Office Spoofing Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.

Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the AFParseDateEx method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7453.

Windows HTML Platforms Security Feature Bypass Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Windows MSHTML Platform Security Feature Bypass Vulnerability

Microsoft Power Platform Connector Spoofing Vulnerability

Windows Compressed Folder Tampering Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Windows MSHTML Platform Security Feature Bypass Vulnerability

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.

Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.

Windows Compressed Folder Tampering Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

Visual Studio Elevation of Privilege Vulnerability

The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.