CVEs

Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.

Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

Use after free in Windows Unified Consent System allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap m