The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062.

Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

Windows Remote Access Connection Manager Information Disclosure Vulnerability

GDI+ Information Disclosure Vulnerability

ASP.NET Core and Visual Studio Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.

Windows Bind Filter Driver Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 29258.

Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability

Event Tracing for Windows Information Disclosure Vulnerability

When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image

Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

Windows Graphics Component Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610.

Windows Installer Information Disclosure Vulnerability

Windows Kernel Information Disclosure Vulnerability

Windows CSC Service Information Disclosure Vulnerability

Microsoft Windows Codecs Library Information Disclosure Vulnerability

Windows GDI+ Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.

Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.

Windows Portmapping Information Disclosure Vulnerability

Windows Event Tracing Information Disclosure Vulnerability

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt database credentials by reading the cryptographic key from the executable. This issue affects ImageDirector Capture: from 7.0.9 before 7.6.3.25808.

Windows Kernel Information Disclosure Vulnerability

Windows ActiveX Installer Service Information Disclosure Vulnerability

Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally.

Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally.

Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.

Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.

Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30991, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

Windows Overlay Filter Information Disclosure Vulnerability