Victor Mata

**Name of the Vulnerable Software and Affected Versions** NATS nats-server versions 2.2.0 through 2.7.4 **Description** The issue allows directory traversal due to an unintended path to a management action from a management account. This is caused by an unintended path in the management account of the NATS nats-server. **Recommendations** For versions 2.2.0 through 2.7.4, update to a version that fixes the directory traversal issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Print Spooler (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows Print Spooler, which can be exploited to elevate privileges. This allows an attacker to affect the system. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NATS Server versions prior to 2.7.2 NATS Streaming Server versions prior to 0.24.1 **Description** The issue is related to Incorrect Access Control in NATS nats-server, where any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. This is due to a coding error in an experimental feature that allowed clients to authorize into any account. A client can craft the initial protocol-level handshake to switch into any other account, including the System account, which controls nats-server core operations. For deployments not using multi-tenancy, normal users can choose to be in the System account. **Recommendations** For NATS Server versions prior to 2.7.2, upgrade to version 2.7.2 or later. For NATS Streaming Server versions prior to 0.24.1, upgrade to version 0.24.1 or later.

**Name of the Vulnerable Software and Affected Versions** Windows Print Spooler (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows Print Spooler, which can be exploited to elevate privileges. This allows an attacker to affect the system. No information is provided about the estimated number of potentially affected devices or real-world incidents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Print Spooler (affected versions not specified) **Description** A remote code execution issue exists due to the Windows Print Spooler service improperly performing privileged file operations. This allows an attacker to run arbitrary code with SYSTEM privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited by sending a specially crafted request, potentially allowing attackers to execute arbitrary code and affect the system. **Recommendations** To prevent exploitation, stop and disable the Print Spooler service. As a temporary workaround, consider disabling the Print Spooler service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.