Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.

An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local authenticated user to read or modify sensitive log data via write access to a shared memory section.

A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure via re-using the enrollment code.

<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>

<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.</p>

IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interface on Windows that they should not have access to due to incorrect file permissions. IBM X-Force ID: 157981.

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due to weak file permissions. IBM X-Force ID: 192469.

Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00.

Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL data sources.

ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode.

Windows Group Policy Elevation of Privilege Vulnerability

Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.

Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.

Skype for Business Information Disclosure Vulnerability

Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

Azure Entra ID Elevation of Privilege Vulnerability

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.

Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.

Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.

Microsoft SharePoint Server Information Disclosure Vulnerability

Active Directory Domain Services Information Disclosure Vulnerability

Windows Group Policy Security Feature Bypass Vulnerability

Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Azure DevOps Server Elevation of Privilege Vulnerability

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Azure Networking Elevation of Privilege Vulnerability

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.