Microsoft Windows PowerShell Code Execution / Event Log Bypass Vulnerabilities

Prior work from this researcher disclosed how PowerShell executes unintended files or BASE64 code when processing specially crafted filenames. This research builds on their PSTrojanFile work, adding a PS command line single quote bypass and PS event logging failure. On Windows CL tab, completing ...

Microsoft Windows Installed

Binary data microsoftwindowsinstalled.nbin...

Zero-Click Outlook RCE Exploitation Chain in Windows

Summary: Two vulnerabilities CVE-2023-35384 and CVE-2023-36710 in Microsoft Windows can be chained to achieve remote code execution RCE on vulnerable Outlook clients. Attackers can exploit these flaws by sending a crafted email with a custom notification sound file to trigger the download of a...

Microsoft Windows win32kfull UMPDDrvCopyBits Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

Microsoft Windows Multiple Vulnerabilities (KB5033372)

This host is missing an important security update according to Microsoft KB5033372 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Defender Antimalware Platform DoS Vulnerability (Dec 2023)

This host is missing a critical security update according to Microsoft Security Updates released for Microsoft Windows Defender Protection Engine dated 13-12-2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Microsoft Windows Multiple Vulnerabilities (KB5033369)

This host is missing an important security update according to Microsoft KB5033369 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5033379)

This host is missing a critical security update according to Microsoft KB5033379 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5033371)

This host is missing an important security update according to Microsoft KB5033371 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5033373)

This host is missing an important security update according to Microsoft KB5033373 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5033375)

This host is missing an important security update according to Microsoft KB5033375 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Internet Connection Sharing security vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Internet Connection Sharing ICS. An attacker could exploit the vulnerability to elevate privileges. The following...

Microsoft Windows Cloud Files Mini Filter Driver Security Vulnerability

Microsoft Windows Cloud Files Mini Filter Driver is a cloud file filter driver from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Cloud Files Mini Filter Driver. An attacker could exploit this vulnerability to gain elevated privileges. The following products and...

Microsoft Windows DHCP Server Security Vulnerability

Microsoft Windows is a set of operating systems used by Microsoft Corporation USA for personal devices. A security vulnerability exists in Microsoft Windows DHCP Server. An attacker exploiting this vulnerability could gain access to sensitive information. The following products and editions are...

Microsoft Windows Internet Connection Sharing (ICS) security vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Internet Connection Sharing ICS. An attacker exploiting this vulnerability could remotely execute code. The...

KLA62388 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, overwrite arbitrary files, gain privileges, spoof user interface. Below is a complete list of...

Microsoft Windows: Virtual Secure Mode

When using Virtual Secure Mode VSM SHOULD It should be taken into account that forensic investigations, e.g. B. for security incident handling be restricted or made more difficult. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and a...

CVE-2023-6352

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

CVE-2023-6352

CVE-2023-6352 affects Aquaforest TIFF Server. The default configuration allows access to arbitrary file paths, subject to IIS/Windows restrictions. Depending on how TIFF Server is used in a web application, a remote attacker may enumerate files/directories, traverse directories, bypass authentica...

Microsoft DWM Core Library Privilege Escalation

The vulnerability of the Microsoft DWM Core Library on Windows operating systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...