Ripfran

A relative path traversal issue exists that allows an authorized attacker to elevate privileges locally. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Weak authentication in the Windows Language Experience Service allows an authorized attacker to perform local tampering, which enables them to affect the system.

Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Missing authentication for a critical function in the Windows StateRepository API allows an authorized attacker to perform local tampering, which can affect the system.

An integer underflow (wrap or wraparound) occurs, which allows an authorized attacker to elevate privileges locally and affect the system. Integer underflow is a condition where a subtraction operation results in a value smaller than the minimum representable value for that data type, causing it to wrap around to a very large positive number.

Files or directories accessible to external parties in Windows Event Viewer allow an authorized attacker to disclose sensitive information over a network, which can subsequently affect the system.

Greenshot is a Windows screenshot utility. Versions prior to 1.3.301 deserialize attacker-controlled data received in a WM COPYDATA message using `BinaryFormatter.Deserialize` without prior validation or authentication. This allows a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic is located in a WinForms WndProc handler for the WM COPYDATA message (message 74), which copies supplied bytes into a `MemoryStream` and invokes `BinaryFormatter.Deserialize`, with authorization checks occurring after deserialization. This allows any gadget chain embedded in the serialized payload to execute regardless of channel membership. A local attacker who can send a WM COPYDATA message to the Greenshot main window can achieve in-process code execution.