Microsoft Windows

RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure

RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption

Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.

An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Git clone remote code execution vulnerability in git-for-windows

Heap buffer overflow when handling crafted font file could lead to arbitrary code execution

Server-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication bypass. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to bypass Adapter authentication.

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

AquaNPlayer directory traversing vulnerability

Lightroom Classic | Deserialization of Untrusted Data (CWE-502)

A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.

Dreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Integer Overflow in RecordedSourceSurfaceCreation

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Insecure renegotiation in SSL protocol caused Denial of service attack in Privileged Account Manager

Shescape on Windows escaping may be bypassed in threaded context

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

Client Proxy (MCP) - Authentication Bypass vulnerability

bandisoft ARK library heap overflow vulnerability

Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Mobile VPN with SSL Local Privilege Escalation Vulnerability

Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Illustrator | Untrusted Search Path (CWE-426)

Adobe Framemaker | Untrusted Search Path (CWE-426)

Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)

Photoshop Desktop | Uncontrolled Search Path Element (CWE-427)

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Dreamweaver Desktop | Improper Access Control (CWE-284)

Illustrator | Untrusted Search Path (CWE-426)

Dreamweaver Desktop | Improper Input Validation (CWE-20)

Dreamweaver Desktop | Improper Input Validation (CWE-20)

Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

Dreamweaver Desktop | Improper Input Validation (CWE-20)

SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

Dreamweaver Desktop | Cross-Site Request Forgery (CSRF) (CWE-352)