Pwnull

The issue is related to insufficient access control in the Winlogon program of Windows operating systems. It allows an attacker to elevate their privileges.

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

The issue is related to broken access control in Spring Security when the `AuthenticatedVoter#vote` function is used directly with a null `Authentication` parameter. This could allow an unauthenticated attacker to expose assets in the environment that are susceptible to exploitation, with a high impact on confidentiality and low impact on integrity. Approximately 8,638 results have been found, mainly distributed in the United States and Canada.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3, IIOP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. It is estimated that over 10,000 services are potentially affected.

A vulnerability in the Apache Batik library for working with SVG images is related to insufficient checking of incoming requests. This issue allows an attacker to run untrusted Java code from an SVG, potentially enabling remote execution of arbitrary Java code. The estimated impact of this issue is high, with potential exposure of assets in the environment susceptible to exploitation, affecting confidentiality.