Eric Lawrence

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Windows (الإصدارات المتأثرة غير محددة) الوصف: قد يؤدي التعامل غير السليم مع تكافؤ المسارات في وظيفة MapUrlToZone بنظام Windows إلى تمكين مهاجم غير مصرح له من التحايل على أحد إجراءات الأمان عبر الشبكة. وقد يؤثر هذا التحايل على النظام. التوصيات: لا توجد في الوقت الحالي أي معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

تتعلق المشكلة بأخطاء في عرض المعلومات عبر واجهة المستخدم الخاصة بمكون Windows SmartScreen، المسؤول عن الحماية من التصيد الاحتيالي والبرامج الضارة. وقد يتيح ذلك لمهاجم عن بُعد تنفيذ هجمات انتحال الهوية.

The issue is related to a security feature bypass vulnerability in the Windows SmartScreen component, which is associated with errors in security settings. Exploitation of this issue may allow a remote attacker to bypass security restrictions by opening a specially crafted malicious file. It has been reported that this issue is being exploited in the wild.

The issue is related to a use after free in Vulkan, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information.

The issue is related to the handling of USSD codes in tel: links. When a user clicks on such a link, USSD codes specified after a `*` character are included in the phone number. This could potentially lead to actions being performed on a user's account, similar to a cross-site request forgery attack, on certain phones or with certain carriers.

The issue is related to insufficient policy enforcement in the networking component of Google Chrome. This could allow a remote attacker to obtain potentially sensitive information from process memory, potentially through social engineering tactics that convince a user to enable logging.

Name of the Vulnerable Software and Affected Versions: Internet Explorer version 11 Description: A security feature bypass issue exists in Internet Explorer, allowing for the bypassing of Mark of the Web Tagging (MOTW). This means that a large number of Microsoft security technologies are bypassed when the MOTW is not set. Recommendations: For Internet Explorer version 11, ensure that the Mark of the Web Tagging (MOTW) is properly set to prevent bypassing of Microsoft security technologies.

The issue is related to the browser ignoring leading characters in javascript URLs pasted into the address bar, potentially allowing remote attackers to conduct cross-site scripting attacks. This could be exploited through social engineering tactics, convincing users to copy and paste malicious text into the address bar, leading to self-cross-site-scripting (self-XSS) attacks.

The issue allows video files to load video captions cross-origin without checking for the presence of CORS headers, potentially leading to information disclosure for video captions.

The issue is related to the improper enforcement of Extended Validation (EV) SSL Certificate guidelines, which disallow the use of wildcard certificates. This could allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority. An attacker could bypass EV SSL certificate guidelines by using a wildcard certificate. EV SSL certificates issued by Certificate Authorities (CA) in compliance with Extended Validation (EV) SSL Certificate guidelines cannot be used to exploit this issue.