Cameron Vincent

**Name of the Vulnerable Software and Affected Versions** Visual Studio (affected versions not specified) **Description** An elevation of privilege issue exists due to improper handling of pipeline job tokens by Visual Studio. This could allow an attacker to extend their access to a project if they already have access and can swap a short-term token for a long-term one. The issue is addressed by correcting how the Visual Studio updater handles these tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Airlift (affected versions not specified) **Description** The issue allows an authorized attacker to elevate privileges over a network by exploiting an authentication bypass vulnerability based on assumed-immutable data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Dynamics 365 Field Service On-Premises version 7 **Description** The issue is related to weak authentication in Microsoft Dynamics 365, allowing an unauthenticated attacker to elevate privileges over a network. This can enable a remote attacker to gain unauthorized access. **Recommendations** For Microsoft Dynamics 365 Field Service On-Premises version 7, patch immediately to mitigate the risk. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) **Description** The issue is related to errors in the user interface's information display. It may allow a remote attacker to gain unauthorized access to protected information. The vulnerability can lead to the disclosure of sensitive information and potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) **Description** The issue is related to insufficient protection of service data in Microsoft SharePoint Server, which can be exploited by a remote attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) **Description** The issue exists due to insufficient input validation in Microsoft SharePoint packages, allowing an attacker to conduct spoofing attacks. This can affect the system. **Recommendations** For Microsoft SharePoint Server, consider restricting access to vulnerable components until a fix is available. For Microsoft SharePoint Enterprise Server, restrict access to vulnerable modules to minimize the risk of exploitation. For Microsoft SharePoint Foundation, avoid using vulnerable parameters in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) **Description** The issue is related to insecure privilege management in Microsoft SharePoint, allowing a remote attacker to elevate their privileges. This can potentially impact the system. **Recommendations** For Microsoft SharePoint Server, update to a version that includes a fix for the insecure privilege management issue. For Microsoft SharePoint Foundation, apply configuration changes to restrict privilege elevation until a patch is available. For Microsoft SharePoint Enterprise Server, consider disabling vulnerable features or modules to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive areas of the system to prevent potential abuse of elevated privileges.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint (affected versions not specified) **Description** The issue is related to insecure privilege management in Microsoft SharePoint. It allows a remote attacker to exploit the vulnerability, potentially elevating their privileges and executing arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Foundation (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Description: An information disclosure issue exists due to improper handling of objects in memory by Microsoft SharePoint Server. This could allow an attacker to obtain information that could further compromise the user's system. To exploit this issue, an attacker would need to log on to an affected system and run a specially crafted application. The security update addresses this by correcting how Microsoft SharePoint Server handles objects in memory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** A spoofing issue exists due to improper handling of web requests by Outlook Web Access (OWA) in Microsoft Exchange Server. This could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted link. The attacker could perform script or content injection attacks, trick the user into disclosing sensitive information, or redirect the user to a malicious website that could spoof content. The issue could also be used to chain an attack with other vulnerabilities in web services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** A tampering issue exists due to Microsoft Exchange Server's improper handling of profile data. This could allow a remote attacker to modify a targeted user's profile data using a specially crafted request. The attacker would need to be authenticated on an affected Exchange Server to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** A tampering issue exists due to Microsoft Exchange Server's failure to properly handle profile data. This could allow a remote attacker to modify a targeted user's profile data. The attacker would need to be authenticated on an affected Exchange Server to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server 2016 versions Cumulative Update 7 through Cumulative Update 8 Description: An information disclosure issue exists due to how data is imported. This could allow an attacker to discover sensitive information that should otherwise not be disclosed, particularly if the impacted user is using Microsoft Exchange Outlook Web Access (OWA). Recommendations: For Microsoft Exchange Server 2016 Cumulative Update 7, update to a version that fixes the information disclosure vulnerability. For Microsoft Exchange Server 2016 Cumulative Update 8, update to a version that fixes the information disclosure vulnerability.