<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>

Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.

<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

Visual Studio Code Information Disclosure Vulnerability

Microsoft BizTalk ESB Toolkit Spoofing Vulnerability

Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

Remote Desktop Protocol Client Information Disclosure Vulnerability

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

Microsoft Accessibility Insights for Web Information Disclosure Vulnerability

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

NTLM Hash Disclosure Spoofing Vulnerability

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

Microsoft Power Platform Connector Spoofing Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

Windows MSHTML Platform Security Feature Bypass Vulnerability

External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

Windows MSHTML Platform Security Feature Bypass Vulnerability

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Windows Installer Elevation of Privilege Vulnerability

Windows Compressed Folder Tampering Vulnerability

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.