Naor Hodorov

A vulnerability to perform a privilege escalation attack on the server as a non-admin user.

The issue is related to improper access control in the Windows SDK, allowing an authorized attacker to elevate privileges locally. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to an incorrect reference resolution before accessing a file, which can lead to a denial of service. An attacker could exploit this to cause a service disruption.

This issue allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the G DATA AntiVirus Scan Server. By creating a symbolic link, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM.

This issue allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read arbitrary files. An attacker can leverage this issue to disclose stored credentials, leading to further compromise. Over 13,000 services are potentially affected.

Name of the Vulnerable Software and Affected Versions: Avast Antivirus versions prior to 24.2 Description: A vulnerability exists within the "Repair" feature of Avast Antivirus, which attempts to delete a file in the current user's AppData directory as NT AUTHORITYSYSTEM. A low-privileged user can create a pseudo-symlink and a junction folder, pointing to a file on the system, allowing them to elevate their privilege and potentially delete arbitrary files or run processes as NT AUTHORITYSYSTEM. This can be achieved by exploiting a race-condition, which can lead to the recreation of system files and allow the execution of a specially-crafted file, potentially launching a privileged shell instance. Recommendations: For Avast Antivirus versions prior to 24.2, update to version 24.2 or later to resolve the issue. As a temporary workaround, consider disabling the "Repair" feature in the settings until the update is applied. Restrict access to the AppData directory to minimize the risk of exploitation. Avoid using the "Repair" function until the issue is resolved.

The issue is related to errors in processing input data in the Core component of Oracle VM VirtualBox. This can be exploited by an attacker to elevate privileges or execute arbitrary code by manipulating log files. The vulnerability applies to Windows hosts only and can result in the takeover of Oracle VM VirtualBox. Successful attacks can compromise the confidentiality, integrity, and availability of the system.