Windows Print Spooler Components Elevation of Privilege Vulnerability

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Microsoft Office Excel Information Disclosure Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally.

WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Blind SQL Injection.This issue affects GeoDirectory: from n/a through 2.8.162.

In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource. An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`. The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

Microsoft Office Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Windows Remote Desktop Services Remote Code Execution Vulnerability

Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.

Windows DNS Server Remote Code Execution Vulnerability

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

Windows DHCP Server Remote Code Execution Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network.

Windows DNS Remote Code Execution Vulnerability

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

Windows Performance Counters Information Disclosure Vulnerability

Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.

Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Servicing Stack Updates Elevation of Privilege Vulnerability

Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

Microsoft QUIC Denial of Service Vulnerability

Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.

AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update

Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.

Windows Client for NFS Remote Code Execution Vulnerability

Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Windows Kernel Transaction Manager Elevation of Privilege Vulnerability

Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.

Windows GDI Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.