CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2023-35359 – Windows Kernel Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2023-35359
Windows Kernel Elevation of Privilege Vulnerability This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Furthermore, exploitation is possible only in limited circumstances. The specific flaw exists within the processing of unhandled exceptions. By redirecting a DOS device, an attacker can abuse a high-privileged service to launch an arbitrary executable. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a high-privileged service account. • http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35359 • CWE-23: Relative Path Traversal •
CVSS: 5.5EPSS: 0%CPEs: 84EXPL: 0CVE-2023-20588 – Speculative Leaks
https://notcve.org/view.php?id=CVE-2023-20588
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. Un error de división por cero en algunos procesadores AMD puede potencialmente devolver datos especulativos que resulten en una pérdida de confidencialidad. • http://www.openwall.com/lists/oss-security/2023/09/25/3 http://www.openwall.com/lists/oss-security/2023/09/25/4 http://www.openwall.com/lists/oss-security/2023/09/25/5 http://www.openwall.com/lists/oss-security/2023/09/25/7 http://www.openwall.com/lists/oss-security/2023/09/25/8 http://www.openwall.com/lists/oss-security/2023/09/26/5 http://www.openwall.com/lists/oss-security/2023/09/26/8 http://www.openwall.com/lists/oss-security/2023 • CWE-369: Divide By Zero •
CVSS: 5.6EPSS: 0%CPEs: 301EXPL: 1CVE-2023-20569 – amd: Return Address Predictor vulnerability leading to information disclosure
https://notcve.org/view.php?id=CVE-2023-20569
A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Una vulnerabilidad de canal lateral en algunas de las CPU de AMD puede permitir que un atacante influya en la predicción de la dirección de retorno. Esto puede dar lugar a una ejecución especulativa en una dirección controlada por el atacante, lo que podría conducir a la divulgación de información. A side channel vulnerability was found in hw amd. • http://www.openwall.com/lists/oss-security/2023/08/08/4 http://xenbits.xen.org/xsa/advisory-434.html https://comsec.ethz.ch/research/microarch/inception https://lists.debian.org/debian-lts-announce/2023/08/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4E4TZNMLYL2KETY23IPA43QXFAVJ46V https://lists.fedoraproject.org/archives/list/pack • CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 7%CPEs: 15EXPL: 7CVE-2023-36884 – Microsoft Windows Search Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-36884
Windows Search Remote Code Execution Vulnerability Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. • https://github.com/jakabakos/CVE-2023-36884-MS-Office-HTML-RCE https://github.com/Maxwitat/CVE-2023-36884-Scripts-for-Intune-Remediation-SCCM-Compliance-Baseline https://github.com/tarraschk/CVE-2023-36884-Checker https://github.com/zerosorai/CVE-2023-36884 https://github.com/raresteak/CVE-2023-36884 https://github.com/ridsoliveira/Fix-CVE-2023-36884 https://github.com/ToddMaxey/CVE-2023-36884 http://seclists.org/fulldisclosure/2023/Jul/43 https://msrc.microsoft.com/update-guide/vulner • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2023-36871 – Azure Active Directory Security Feature Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-36871
Azure Active Directory Security Feature Bypass Vulnerability • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36871 •