Microsoft

Azure Site Recovery Information Disclosure Vulnerability

Azure Site Recovery Information Disclosure Vulnerability

Microsoft Power BI Information Disclosure Vulnerability

Active Directory Security Feature Bypass Vulnerability

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including…

This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a specially crafted authentication request, aka 'Local Security Authority Subsystem Service Denial of Service Vulnerability'.

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.

ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow…

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that Microsoft Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from…

The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a…

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft…

Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow attackers to bypass the Secure Boot protection mechanism by leveraging (1) administrative or (2) physical access to install a crafted boot manager, aka "Secure Boot…

Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.

Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.

Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.

Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker…

Use after free in Windows Kernel allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally.

Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally.

Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose information locally.

Use after free in Windows Overlay Filter allows an authorized attacker to disclose information over a network.

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally.

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.