Gábor Selján

An issue exists in the Windows Graphics Component that involves an out-of-bounds read in memory. Successful exploitation may allow an attacker to gain unauthorized access to protected information. The issue allows attackers to obtain sensitive information and affect the system.

An integer overflow or wraparound exists in Microsoft Office, potentially allowing an authorized attacker to elevate privileges locally. The issue involves an integer overflow, which can lead to unexpected behavior and potentially allow an attacker to gain higher-level access within the system.

A heap-based buffer overflow exists in Windows GDI+, where a heap-based buffer overflow is a memory corruption issue that occurs when a program writes more data to a heap-allocated memory block than it can hold. This flaw allows an unauthorized remote attacker to execute arbitrary code and gain unauthorized access to protected information by loading a specially crafted metafile or through malicious websites.

Name of the Vulnerable Software and Affected Versions: Windows GDI (affected versions not specified) Description: The issue is related to a protection mechanism failure in Windows GDI, allowing an unauthorized attacker to disclose information over a network. This failure enables the attacker to access sensitive data without proper authorization. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Win32K versions prior to the fixed version Description: The issue is a heap-based buffer overflow in Windows Win32K - GRFX, allowing an unauthorized attacker to execute code locally. This enables an attacker to gain SYSTEM-level access via improper memory handling. The vulnerability can be exploited by remote attackers to execute arbitrary code and affect the system. Recommendations: For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the GRFX component until a patch is applied. Avoid using the vulnerable Windows Win32K - GRFX functionality until the issue is resolved.

An untrusted search path vulnerability in testinitsigs.exe allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file. This issue enables an attacker to gain elevated privileges.

The issue is related to a post-authentication command injection vulnerability. It could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands by sending a crafted query parameter attached to the URL of an affected device’s web management interface. This is due to the lack of measures to neutralize special elements used in the operating system command.

The issue arises from the improper neutralization of special elements in the WSGI server, allowing an unauthenticated attacker to execute some operating system commands by sending a crafted URL to a vulnerable device. This could enable a remote attacker to execute arbitrary OS commands.

A command injection issue exists in the web server of the Zyxel NAS326 and NAS542 firmware due to the lack of neutralization of special elements used in operating system commands. This could allow a remote attacker to execute arbitrary operating system commands by sending a specially crafted URL to a vulnerable device.

A post-authentication command injection issue in the WSGI server of the Zyxel NAS326 and NAS542 firmware could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device. The vulnerability is related to the failure to neutralize special elements used in OS commands, which can be exploited by sending a specially crafted URL to the device.

The issue is related to the improper neutralization of special elements in the CGI program of the Zyxel NAS326 and NAS542 firmware. This could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

The issue is related to a lack of protection for sensitive data in the Windows Graphics Component. Exploitation of this issue may allow an attacker to disclose protected information. It is described as an out-of-bounds read information disclosure vulnerability in MS Windows GDI+ EMR SETPIXELV record. This could potentially allow attackers to access important information and impact the system.

The issue is related to a lack of protection for sensitive data in the Windows Graphics Component. It may allow a remote attacker to gain unauthorized access to a device using a specially crafted file. The vulnerability can be exploited to obtain sensitive information and affect the system.

The issue is related to a lack of protection for sensitive data in the Windows Graphics component of the Windows operating system. It allows a remote attacker to disclose protected information by using a specially crafted file. The vulnerability can be exploited to obtain sensitive information and affect the system.

The issue is related to an information disclosure vulnerability in the Windows Graphics Component. It allows a remote attacker to gain unauthorized access to protected information. This can potentially lead to the exposure of sensitive data.

The issue is related to an information disclosure vulnerability in the Windows Graphics Component. It may allow a remote attacker to gain unauthorized access to protected information. The vulnerability can be exploited to obtain sensitive information and affect the system.

The issue is related to insufficient access controls in the Windows GDI+ component, which can be exploited to disclose protected information. This can allow an attacker to obtain sensitive information and affect the system. No specific details about the estimated number of potentially affected devices or real-world incidents are provided.

The issue is related to an information disclosure in the Windows GDI component, which can allow a remote attacker to gain unauthorized access to protected information. This can potentially lead to the exposure of sensitive data. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to insufficient access restrictions in the Windows GDI component, allowing an attacker to potentially elevate their privileges. This could impact the system, enabling attackers to affect it.

The issue is related to an elevation of privilege vulnerability in the "Public Account Pictures" folder, which improperly handles junctions. To exploit this, an attacker must first gain execution on the victim system. This allows the attacker to potentially elevate their privileges.