Alex Birnberg

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.30.63 **Description** An out-of-bounds read issue exists in the allocation of image buffers. This can allow a local attacker to access memory outside of the intended boundaries. **Recommendations** Update Samsung Notes to version 4.4.30.63 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.30.63 **Description** An out-of-bounds write issue exists in the SPI decoder of Samsung Notes. This allows a local attacker to write to memory outside of the allocated buffer. **Recommendations** Update Samsung Notes to version 4.4.30.63 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.30.63 **Description** An out-of-bounds read issue exists in the parsing of image data. This can allow a local attacker to access memory outside of the intended boundaries. **Recommendations** Update Samsung Notes to version 4.4.30.63 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.30.63 **Description** An out-of-bounds read issue exists in the reading of image data within Samsung Notes. This allows a local attacker to access memory outside of the intended boundaries. **Recommendations** Update Samsung Notes to version 4.4.30.63 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.30.63 **Description** An out-of-bounds read issue exists in the SPI decoder. This allows local attackers to access memory outside of the intended boundaries. **Recommendations** Update Samsung Notes to version 4.4.30.63 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.26.71 **Description** The issue is related to an out-of-bounds read in the parsing of wbmp images. This allows local attackers to access out-of-bounds memory. **Recommendations** For versions prior to 4.4.26.71, update to version 4.4.26.71 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.26.71 **Description** The issue is related to an out-of-bounds read when applying binary handwriting content in Samsung Notes. This allows attackers to read out-of-bounds memory. **Recommendations** For versions prior to 4.4.26.71, update to version 4.4.26.71 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Notes versions prior to 4.4.26.71 **Description** The issue is related to an out-of-bounds read in parsing image data, allowing local attackers to access out-of-bounds memory. **Recommendations** For versions prior to 4.4.26.71, update to version 4.4.26.71 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Windows Cloud Files Mini Filter Driver (affected versions not specified) **Description** An elevation of privilege issue exists in the Windows Cloud Files Mini Filter Driver `cldflt.sys`. The flaw is a heap-based buffer overflow that can be triggered by crafting a custom reparse point to corrupt an adjacent ` WNF STATE DATA` object. This corruption can be leveraged to leak kernel pointers from an ALPC handle table object. Further exploitation involves a second buffer overflow to corrupt another ` WNF STATE DATA` object and a subsequent PipeAttribute object. By forging a PipeAttribute object in userspace, an attacker can leak the token address and override privileges to escalate a regular user account to NT AUTHORITYSYSTEM. Technical exploitation strategies include the use of WNF Out-of-Bounds (OOB), ALPC, I/O Ring mechanisms, and flipping the ` KTHREAD.PreviousMode` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Orion Platform (affected versions not specified) **Description** A SQL Injection Remote Code vulnerability was found in the SolarWinds Platform, which can be exploited with a low-privileged account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server versions prior to 16.0.10372.20060 **Description** The issue is related to insufficient input validation in Microsoft SharePoint Server, allowing a remote attacker to perform spoofing attacks using a specially crafted request. This can be exploited through the GetXmlDataFromDataSource function, leading to a Server-Side Request Forgery (SSRF) vulnerability. **Recommendations** For Microsoft SharePoint Server version 16.0.10372.20060 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the GetXmlDataFromDataSource function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Horde Groupware Webmail Edition versions through 5.2.22 Description: An XSS issue was discovered, allowing an attacker to send a plain text e-mail message with JavaScript encoded as a link or email. This is mishandled by `preProcess` in `Text2html.php` due to bespoke use of `x00x00x00` and `x01x01x01`, which interferes with XSS defenses. Recommendations: For Horde Groupware Webmail Edition versions through 5.2.22, update the Horde Text Filter library to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the handling of plain text e-mail messages with JavaScript encoded links or emails to minimize the risk of exploitation.