CVSS: 7.8EPSS: 0%CPEs: 38EXPL: 0CVE-2021-43238 – Windows Remote Access Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2021-43238
Windows Remote Access Elevation of Privilege Vulnerability Una vulnerabilidad de Elevación de Privilegios en Windows Remote Access This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Remote Access Connection Manager service. By creating a directory junction, an attacker can abuse the service to create a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43238 https://www.zerodayinitiative.com/advisories/ZDI-22-019 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2021-43237 – Windows Setup Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2021-43237
Windows Setup Elevation of Privilege Vulnerability Una vulnerabilidad de Elevación de Privilegios en Windows Setup This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional user interaction is required in that an administrator must begin a version update of Windows. The specific flaw exists within Windows Update Assistant. By creating a directory junction, an attacker can abuse Windows Update Assistant to change the DACL on an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43237 https://www.zerodayinitiative.com/advisories/ZDI-22-018 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 29EXPL: 0CVE-2021-43235 – Storage Spaces Controller Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-43235
Storage Spaces Controller Information Disclosure Vulnerability Una vulnerabilidad de Divulgación de Información de Storage Spaces Controller. Este ID de CVE es diferente de CVE-2021-43227 • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43235 •
CVSS: 7.5EPSS: 3%CPEs: 36EXPL: 0CVE-2021-43236 – Microsoft Message Queuing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-43236
Microsoft Message Queuing Information Disclosure Vulnerability Una vulnerabilidad de Divulgación de Información en Microsoft Message Queuing. Este ID de CVE es diferente de CVE-2021-43222 • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43236 •
CVSS: 7.8EPSS: 13%CPEs: 36EXPL: 0CVE-2021-43234 – Windows Fax Service Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-43234
Windows Fax Service Remote Code Execution Vulnerability Una vulnerabilidad de Ejecución de Código Remota en Windows Fax Service • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43234 •