Halov

An issue in Razer Synapse 3 allows a local attacker to execute arbitrary code via the `export` parameter of the `Chroma Effects` function in the `Profiles` component.

A vulnerability in the update process of Docker Desktop for Windows could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:ProgramDataDockerconfig with high privileges. However, this directory often does not exist by default, and C:ProgramData allows normal users to create new directories. By creating a malicious Dockerconfig folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege.

A denial-of-service vulnerability could allow a local attacker to overwrite arbitrary files in the context of SYSTEM, but the attacker must first obtain the ability to execute low-privileged code on the target system.

A link following privilege escalation issue could allow a local attacker to create a specially crafted file with arbitrary content, potentially granting local privilege escalation on the affected system. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue.

The issue is related to an inappropriate implementation in Google Updater in Google Chrome on Windows, which is associated with insecure privilege management. This allows a remote attacker to perform local privilege escalation via a crafted file.

The issue is related to a directory junction vulnerability. This could allow an attacker to exploit the system, potentially escalating privileges and creating a denial of service.

The issue is related to the Windows User Profile Service and is associated with insufficient access restrictions. It allows an attacker to elevate their privileges. The vulnerability can be exploited if the attacker knows the username and password of another user. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The vulnerability is related to insufficient access control in the Windows Recovery Environment Agent component of Microsoft Windows operating systems. This issue can be exploited to elevate privileges. There is also a mention of an improper access control authentication bypass vulnerability in the Microsoft Windows Lock Screen. An elevation-of-privilege vulnerability allows attackers to affect the system.

The issue is related to insufficient access control in the Windows Update Assistant, which can be exploited to elevate privileges.

The issue is related to insufficient access restrictions in the Windows Event Tracing service of Microsoft Windows operating systems. It allows an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Name of the Vulnerable Software and Affected Versions: Trend Micro Maximum Security version 17 Description: The issue is related to an improper access control vulnerability in the installer, which could allow a local attacker to escalate privileges on a target machine. The attacker must already have local user privileges and access on the machine to exploit this issue. Recommendations: For version 17, update to a newer version that addresses the improper access control vulnerability in the installer to prevent privilege escalation.

The issue is related to insufficient access restrictions in the implementation of the user account profile picture in the Windows User Profile Service. It allows an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to insufficient access control in the Microsoft Malware Protection Engine (MPE), which can be exploited to elevate privileges or cause a denial of service.

The issue is related to insufficient policy enforcement in the Google Update component of Google Chrome, allowing a remote attacker to read arbitrary files via a malicious file. This can lead to unauthorized access to protected information.

The issue is related to insufficient input validation in the Windows AppX Deployment Server component of Windows operating systems. This can be exploited by a remote attacker to cause a denial of service.

The issue is related to an elevation-of-privilege vulnerability in the Windows Update Service, which is caused by insecure privilege management. This vulnerability can be exploited to allow an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to a security feature bypass vulnerability in the Windows Extensible Firmware Interface. This vulnerability allows attackers to bypass existing security restrictions. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to improper access control in the Windows Update Assistant, which can be exploited to elevate privileges. This could allow an attacker to affect the system.

The issue is related to insecure privilege management in the Windows User Profile Service. Exploitation of this issue can allow an attacker to elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to an elevation-of-privilege vulnerability in the Windows Update Stack Setup, which is caused by insecure privilege management. This vulnerability can be exploited to allow an attacker to elevate their privileges.