The Telephony component in Apple iOS before 8.3 allows attackers to bypass a sandbox protection mechanism and access unintended telephone capabilities via a crafted app.
Windows Group Policy Elevation of Privilege Vulnerability
Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to modify protected parts of the file system.
An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth.
An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, macOS Monterey 12.7. The issue was addressed with improved handling of caches.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
Skype for Business Information Disclosure Vulnerability
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.
Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
Azure Entra ID Elevation of Privilege Vulnerability
Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08698617; Issue ID: MSV-1394.
Microsoft SharePoint Server Information Disclosure Vulnerability
Active Directory Domain Services Information Disclosure Vulnerability
Windows Group Policy Security Feature Bypass Vulnerability
In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.
Azure DevOps Server Elevation of Privilege Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.
Azure Networking Elevation of Privilege Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.
Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.