Smlijun

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** Microsoft Exchange Server contains a server-side request forgery (SSRF) issue, which occurs when a server fails to properly validate requests. This allows an authorized attacker to perform spoofing over a network. Additionally, incorrect input neutralization during the generation of web pages may lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, further enabling identity spoofing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server 2016 CU23 Microsoft Exchange Server 2019 CU14 Microsoft Exchange Server 2019 CU15 Microsoft Exchange Server SE **Description** Microsoft Exchange Server contains a Server-Side Request Forgery (SSRF) flaw, which occurs when a server fails to properly validate requests. This allows an authorized mailbox user to force the server to make HTTP requests to internal networks, enabling internal network reconnaissance and the disclosure of sensitive information from internal HTTP services. The issue stems from the fact that intranet address validation is gated on the `isBposUser` variable, which is always `false` for on-premises installations, causing them to skip the security check entirely. Exploitation is achieved via a SOAP request to the EWS InstallApp endpoint using a crafted `ManifestUrl` parameter. **Recommendations** Update Microsoft Exchange Server 2016 CU23 to the June 2026 SU. Update Microsoft Exchange Server 2019 CU14 to the June 2026 SU. Update Microsoft Exchange Server 2019 CU15 to the June 2026 SU. Update Microsoft Exchange Server SE to the June 2026 SU.

Name of the Vulnerable Software and Affected Versions: Windows versions (affected versions not specified) Description: A use after free issue exists in Windows PrintWorkflowUserSvc, potentially allowing an authorized attacker to gain elevated privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to a null pointer dereference in Windows Drivers, allowing an unauthorized attacker to elevate privileges locally. This could potentially affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Digital Media (affected versions not specified) Description: The issue is related to a use after free condition in Windows Digital Media, which can be exploited by an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Digital Media (affected versions not specified) Description: The issue is related to a use after free condition in Windows Digital Media, allowing an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Digital Media (affected versions not specified) Description: The issue is related to a use after free condition in Windows Digital Media, allowing an authorized attacker to elevate privileges locally. This elevation-of-privilege vulnerability enables attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System (ReFS) Deduplication Service (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. It is caused by a memory reuse error. Exploitation of this issue may allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System (ReFS) Deduplication Service (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. It is caused by a memory reuse error, which can be exploited to allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iPadOS versions prior to 17.7.4 macOS Ventura versions prior to 13.7.3 macOS Sonoma versions prior to 14.7.3 visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 **Description** The issue was addressed with improved memory handling. Processing an image may lead to a denial-of-service. The vulnerability is related to incorrect cleanup or release of resources in the Image Handler component of the operating systems. **Recommendations** For iPadOS versions prior to 17.7.4, update to iPadOS 17.7.4 or later. For macOS Ventura versions prior to 13.7.3, update to macOS Ventura 13.7.3 or later. For macOS Sonoma versions prior to 14.7.3, update to macOS Sonoma 14.7.3 or later. For visionOS versions prior to 2.3, update to visionOS 2.3 or later. For iOS versions prior to 18.3, update to iOS 18.3 or later. For iPadOS versions prior to 18.3, update to iPadOS 18.3 or later. For macOS Sequoia versions prior to 15.3, update to macOS Sequoia 15.3 or later. For watchOS versions prior to 11.3, update to watchOS 11.3 or later. For tvOS versions prior to 18.3, update to tvOS 18.3 or later.

**Name of the Vulnerable Software and Affected Versions** WebKitGTK versions prior to the fixed version WPE WebKit versions prior to the fixed version tvOS versions prior to 17 Safari versions prior to 17 watchOS versions prior to 10 iOS versions prior to 17 iPadOS versions prior to 17 macOS versions prior to Sonoma 14 **Description** The issue is related to a buffer overflow in memory, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. Processing web content may lead to arbitrary code execution. **Recommendations** For WebKitGTK, update to a version that includes improved memory handling. For WPE WebKit, update to a version that includes improved memory handling. For tvOS, update to version 17 or later. For Safari, update to version 17 or later. For watchOS, update to version 10 or later. For iOS, update to version 17 or later. For iPadOS, update to version 17 or later. For macOS, update to Sonoma 14 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sonoma 14 Safari versions prior to 17 iOS versions prior to 17 iPadOS versions prior to 17 **Description** The issue is caused by a buffer overflow in the WebKit component of the macOS operating system. Exploitation of this issue may allow a local attacker to execute arbitrary code using a specially crafted link. Processing web content may lead to arbitrary code execution. **Recommendations** For macOS versions prior to Sonoma 14, update to macOS Sonoma 14 to resolve the issue. For Safari versions prior to 17, update to Safari 17 to resolve the issue. For iOS versions prior to 17, update to iOS 17 to resolve the issue. For iPadOS versions prior to 17, update to iPadOS 17 to resolve the issue.