PT-2023-1461 · Microsoft · Http.Sys +1

Name of the Vulnerable Software and Affected Versions: Windows HTTP.sys affected versions not specified Description: The issue is related to an information disclosure vulnerability in the HTTP.sys driver of Windows operating systems. This vulnerability can allow an attacker to gain unauthorized...

Microsoft ODBC Driver 安全漏洞

Microsoft ODBC Driver is a driver from Microsoft. It allows applications to access data in a database management system DBMS using SQL as the standard for accessing data. A security vulnerability exists in the Microsoft Windows ODBC Driver. The following products and versions are affected:Windows...

PT-2023-1444 · Microsoft · Peap +1

Name of the Vulnerable Software and Affected Versions: Microsoft Protected Extensible Authentication Protocol PEAP affected versions not specified Description: The issue is related to insufficient input validation in the implementation of the Protected Extensible Authentication Protocol PEAP in...

Path Traversal

vertx-web is vulnerable to Path Traversal. The vulnerability exists in the pathOffset function of Utils.java When running vertx web applications that serve files using the StaticHandler on Windows Operating Systems and Windows File Systems. If the mount point is a wildcard , then an attacker can...

StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route

Summary When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate any class path resource. Details When computing the relative path to locate the resource, in cas...

Input validation

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate a...

CVE-2023-24815 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate a...

The vulnerability of anti-virus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems is related to deficiencies in access control. This allows attackers to increase their privileges.

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Windows Error Reporting error reporting service on Windows operating systems allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Error Reporting registration service on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the WDAC OLE DB component for SQL Server on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the WDAC OLE DB component for SQL Server on Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Win32k.sys component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component of the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the WinSock driver in the Microsoft Windows operating system, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of the WinSock driver in the Microsoft Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Microsoft Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Microsoft Message Queuing MSMQ service on Microsoft Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Microsoft Windows allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Microsoft Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted connection request to the...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Microsoft Windows allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Microsoft Windows operating systems stems from the fact that the operation is performed outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a special...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Microsoft Windows allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Microsoft Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted connection request to the...

Microsoft Patch Tuesday January 2023: ALPC EoP, Win Backup EoP, LocalPotato, Exchange, Remote RCEs

Hello everyone! This episode will be about Microsoft Patch Tuesday for January 2023, including vulnerabilities that were added between December and January Patch Tuesdays. Alternative video link for Russia: As usual, I use my open source Vulristics project to analyse and prioritize vulnerabilitie...

The vulnerability of the Layer 2 Tunneling Protocol (L2TP) implementation in Microsoft Windows allows a hacker to execute arbitrary code.

The vulnerability of the Layer 2 Tunneling Protocol L2TP implementation in Microsoft Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted connection request to the...

The vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) on Microsoft Windows operating systems allows a attacker to cause a service failure.

The vulnerability of the Lightweight Directory Access Protocol LDAP implementation on Microsoft Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures using specially created data...

The vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) on Microsoft Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the LDAP protocol implementation on Microsoft Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created data...