Wayne Low

توجد ثغرة تؤدي إلى كشف المعلومات والانتحال في Windows File Explorer تسمح لمهاجم غير مصرح له عبر الشبكة بالحصول على معلومات حساسة. وتحديداً، تتيح هذه الثغرة سرقة كلمات المرور المشفرة بنظام NTLM. يمكن أن يحدث الاستغلال عندما يتم إقناع المستخدم بفك ضغط أرشيف ضار يحتوي على ملف `.library-ms`؛ وعند فك الضغط، يقوم Windows Explorer تلقائياً ببدء طلب مصادقة SMB إلى خادم يسيطر عليه المهاجم، مما يؤدي إلى تسريب هاش NTLM الخاص بالمستخدم. يمكن أن تحدث هذه العملية دون تفاعل مباشر من المستخدم مع الملف نفسه. تُستخدم هاشات NTLM (New Technology Local Security Authority) بواسطة نظام Windows للمصادقة، ويمكن كسرها لاستعادة كلمات المرور بنص صريح أو استخدامها في هجمات Pass-the-Hash لانتحال شخصية المستخدمين.

قد تسمح ثغرة أمنية في قناة الاتصال بين العمليات (IPC) في Cisco Secure Client لنظام التشغيل Windows لمهاجم محلي معتمد بتنفيذ هجوم اختطاف مكتبة DLL (DLL hijacking) على جهاز متأثر، إذا كان Secure Firewall Posture Engine، المعروف سابقًا باسم HostScan، مثبتًا على Cisco Secure Client. ترجع هذه الثغرة إلى عدم كفاية التحقق من صحة الموارد التي يتم تحميلها بواسطة التطبيق أثناء وقت التشغيل. يمكن للمهاجم استغلال هذه الثغرة الأمنية عن طريق إرسال رسالة IPC مزورة إلى عملية محددة في Cisco Secure Client. وقد يؤدي الاستغلال الناجح إلى تمكين المهاجم من تنفيذ تعليمات برمجية عشوائية على الجهاز المتأثر بامتيازات SYSTEM. لاستغلال هذه الثغرة الأمنية، يجب أن يمتلك المهاجم بيانات اعتماد مستخدم صالحة في نظام Windows.

The issue is related to insufficient input validation in Microsoft Message Queuing (MSMQ) for Windows operating systems. It allows a remote attacker to execute arbitrary code.

The issue is related to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. This can affect the system, potentially leading to data leaks or other security breaches. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to insufficient input validation in Microsoft Message Queuing (MSMQ) for Windows operating systems. It allows a remote attacker to perform a denial-of-service (DoS) attack.

The issue is related to insufficient input validation in the Windows Hyper-V hardware virtualization system, which can be exploited to cause a denial of service. This allows an attacker to affect the system.

The issue is related to incorrect code generation management in the Raw Image Extension plugin. Exploitation of this issue may allow an attacker to execute arbitrary code.

The issue is related to incorrect code generation management in the Raw Image Extension plugin for viewing RAW images. Exploitation of this issue may allow an attacker to execute arbitrary code.

The issue is related to a remote code execution vulnerability. It involves incorrect code generation management in the Raw Image Extension plugin for viewing RAW images. Exploitation of this issue could allow an attacker to execute arbitrary code.

The issue is related to incorrect code generation management in the Raw Image Extension plugin for Microsoft Windows operating systems. It allows remote attackers to execute arbitrary code by sending a specially crafted request. This can affect the system.

The issue is related to incorrect code generation management in the Web Media Extensions package, allowing an attacker to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Microsoft Raw Image Extension (affected versions not specified) Description: The issue is related to a buffer overflow in the MSRawImage Store Raw2Image plugin of the Raw Image Extension. Exploitation of this issue may allow a remote attacker to execute arbitrary code using a specially crafted file. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Raw Image Extension (affected versions not specified) Description: The issue is related to a buffer overflow in the Raw Image Extension plugin. It can be exploited by a remote attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows command injection by an authenticated user.

A buffer overflow issue affects certain NETGEAR devices, allowing an authenticated user to potentially exploit this issue.

The issue is related to stored XSS, which affects certain NETGEAR devices.

The issue is related to stored XSS, which affects certain NETGEAR devices.

The issue affects certain NETGEAR devices, causing a denial of service.

A stack-based buffer overflow issue affects certain NETGEAR devices, allowing an authenticated user to potentially exploit this issue.

The issue is a buffer overflow that can be triggered by an authenticated user.