Gravity0

An integer underflow (wrap or wraparound) occurs in the HID Parser Library, which allows an authorized attacker to elevate privileges over a network. This issue enables attackers to gain higher levels of access to the system.

An out-of-bounds read exists in the Windows USB Hub Driver. This issue allows an authorized attacker to disclose sensitive information locally and potentially affect the system. An out-of-bounds read occurs when the software reads data past the end of the intended buffer, potentially accessing adjacent memory locations.

Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally, which can lead to an elevation-of-privilege impact on the system.

A buffer over-read exists in Windows Management Instrumentation, which allows an authorized attacker to disclose sensitive information locally and affect the system. A buffer over-read occurs when a program reads more data from a buffer than it was intended to, potentially exposing adjacent memory contents.

Improper access control in Windows Print Spooler components allows an authorized attacker to elevate privileges locally, which can lead to full system compromise.

A stack-based buffer overflow occurs in the Software Protection Platform, which allows an authorized attacker to elevate privileges locally. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory.

Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally, which can lead to an elevation-of-privilege impact on the system.

A stack-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory.

A race condition exists in the Windows Point-to-Point Protocol over Ethernet (PPPoE) component. This occurs when concurrent execution uses a shared resource with improper synchronization, allowing an authorized attacker to elevate privileges locally. A race condition is a situation where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events.

An elevation of privilege issue exists in the Network Driver Interface Specification (NDIS) due to a failure in `ndis.sys` to verify buffer length before copying memory. A local attacker could execute a specially crafted application to run processes in an elevated context, provided they already have local system access to execute malicious code.

A buffer over-read exists in Servicing Stack Updates, which allows an authorized attacker to locally disclose sensitive information and affect the system. A buffer over-read occurs when a program reads more data from a buffer than it is intended to, potentially accessing adjacent memory locations.

A heap-based buffer overflow occurs in the Windows Kernel, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruption issue that happens when a program writes more data to a heap-allocated buffer than it can hold.

A use after free issue exists in Windows Kernel-Mode Drivers. This flaw allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

A use-after-free condition in the Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

A use-after-free condition in Windows Print Spooler components allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

An inappropriate implementation in the V8 engine allows a remote attacker to execute arbitrary code within a sandbox. This occurs when a user is convinced to perform specific UI gestures while interacting with a crafted HTML page.

An uninitialized use in the V8 engine allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source JavaScript and WebAssembly engine used by Chrome to execute code.

The issue is related to a use after free in WebApp Installs, which could allow an attacker to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction. This could be achieved if the attacker convinces a user to install a malicious extension. The vulnerability may also allow a remote attacker to disclose protected information using a specially crafted web page.

The issue is related to a use after free in the Notifications component of Google Chrome on ChromeOS, which could allow a remote attacker to potentially exploit heap corruption via UI interaction after convincing a user to reboot Chrome OS. This could impact the integrity of protected information.