In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource. An authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`. The issue is fixed in Eclipse BaSyx Go Components v1.1.4.

Microsoft Office Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Windows Remote Desktop Services Remote Code Execution Vulnerability

Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.

Windows DNS Server Remote Code Execution Vulnerability

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Use after free in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

Windows DHCP Server Remote Code Execution Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network.

Windows DNS Remote Code Execution Vulnerability

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

Windows Performance Counters Information Disclosure Vulnerability

Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.

Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Servicing Stack Updates Elevation of Privilege Vulnerability

Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

Microsoft QUIC Denial of Service Vulnerability

Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.

AES-GCM-SIV AAD Forgery After Zero-length Incremental AAD Update

Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.

Windows Client for NFS Remote Code Execution Vulnerability

Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Windows Kernel Transaction Manager Elevation of Privilege Vulnerability

Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.

Windows GDI Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

Xbox Gaming Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally.

Windows Hyper-V Denial of Service Vulnerability

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

Windows BitLocker Security Feature Bypass Vulnerability

Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.