Zeeshan Shaikh

**Name of the Vulnerable Software and Affected Versions** Windows Snipping Tool (affected versions not specified) **Description** Improper neutralization of special elements used in a command allows an unauthorized attacker to execute arbitrary code locally and remotely, affecting the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iTunes versions prior to 12.12.9 for Windows **Description** The issue is related to a logic problem that has been addressed with improved checks. It may allow an attacker to elevate privileges. **Recommendations** For versions prior to 12.12.9, update to iTunes 12.12.9 for Windows to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Kaspersky VPN Secure Connection for Windows version up to 21.5 **Description** The issue is related to the possibility of arbitrary file deletion in the system via abuse of the 'Delete All Service Data And Reports' feature by a local authenticated attacker. This can potentially allow an attacker to elevate their privileges by creating a specially crafted symbolic link to a critical folder in the system and deleting it using the mentioned feature. The vulnerability threatens remote and work-from-home users. **Recommendations** For Kaspersky VPN Secure Connection for Windows version up to 21.5, consider disabling the 'Delete All Service Data And Reports' feature until a patch is available to prevent exploitation. Restrict access to the 'Инструменты поддержки' (Support Tools) part of the application to minimize the risk of privilege escalation. Avoid using the feature that allows deletion of service data and reports until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Tools for Windows versions 11.x.y prior to 11.2.6 VMware Remote Console for Windows versions 12.x prior to 12.0.1 VMware App Volumes versions 2.x prior to 2.18.10 VMware App Volumes version 4 prior to 2103 **Description** The issue is related to a local privilege escalation vulnerability. An attacker with normal access to a virtual machine may exploit this by placing a malicious file renamed as `openssl.cnf` in an unrestricted directory, allowing code to be executed with elevated privileges. The vulnerability is also associated with an uncontrolled search path element. **Recommendations** For VMware Tools for Windows versions 11.x.y prior to 11.2.6, update to version 11.2.6 or later. For VMware Remote Console for Windows versions 12.x prior to 12.0.1, update to version 12.0.1 or later. For VMware App Volumes versions 2.x prior to 2.18.10, update to version 2.18.10 or later. For VMware App Volumes version 4 prior to 2103, update to version 2103 or later. As a temporary workaround, consider restricting access to unrestricted directories to minimize the risk of exploitation. Avoid using the `openssl.cnf` file in vulnerable configurations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** EPESI version 1.8.2 rev20170830 **Description** The issue concerns Stored XSS in the Tasks Phonecall Notes Title parameter. **Recommendations** For EPESI version 1.8.2 rev20170830, avoid using the `Tasks Phonecall Notes Title` parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EPESI version 1.8.2 rev20170830 **Description** The issue concerns Stored XSS in the `Tasks Description` parameter. **Recommendations** For EPESI version 1.8.2 rev20170830, avoid using the `Tasks Description` parameter until the issue is resolved. Consider temporarily restricting access to this parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.