Skorikari

A security-feature bypass vulnerability in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally. This issue is related to a failure in the protection mechanism, enabling attackers to affect the system. The vulnerability may allow an attacker to bypass existing security restrictions and gain access to encrypted data.

An information disclosure and spoofing issue exists in Windows File Explorer that allows an unauthorized network attacker to obtain sensitive information. Specifically, the flaw enables the theft of NTLM hashed passwords. Exploitation can occur when a user is convinced to extract a malicious archive containing a `.library-ms` file; upon extraction, Windows Explorer automatically initiates an SMB authentication request to an attacker-controlled server, leaking the user's NTLM hash. This process can happen without direct user interaction with the file itself. NTLM (New Technology Local Security Authority) hashes are used by Windows for authentication and can be cracked to recover plain-text passwords or used in Pass-the-Hash attacks to impersonate users.

The issue is related to a denial-of-service vulnerability in the Windows Remote Desktop Gateway (RD Gateway). It is associated with synchronization errors when using a shared resource. Exploitation of this issue can allow an attacker to cause a denial of service.