chromium-browser: Memory corruption in ANGLE

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

chromium-browser: Use after free in Browser

Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

chromium-browser: Improper input validation in Views

Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Kerberos AppContainer Security Feature Bypass Vulnerability

Kerberos AppContainer Security Feature Bypass Vulnerability

Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

Kernel Streaming Service Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.

SQLite Elevation of Privilege Vulnerability

Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally.

Windows Credential Manager Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.

Windows iSCSI Information Disclosure Vulnerability

Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally.

Windows iSCSI Remote Code Execution Vulnerability

Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.

Windows Network File System Information Disclosure Vulnerability

Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.

Windows Kerberos Elevation of Privilege Vulnerability

Windows Kerberos Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Defender Elevation of Privilege Vulnerability'.

tomcat: Remote Code Execution on Windows

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

Windows Text Shaping Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability

Use after free in Windows Camera Frame Server Monitor allows an unauthorized attacker to elevate privileges over an adjacent network.

Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network.