SB2022111615 - Multiple vulnerabilities in Dell Unisphere for PowerMax, Dell Solutions Enabler, Dell Unisphere 360, Dell VASA
Published: November 16, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 98 secuirty vulnerabilities.
1) Security features bypass (CVE-ID: CVE-2021-38624)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to security feature bypass issue in Windows Key Storage Provider. A remote authenticated attacker can bypass the target application
2) Code Injection (CVE-ID: CVE-2021-36965)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows WLAN AutoConfig Service. A remote attacker on the local network can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36966)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Subsystem for Linux, which leads to security restrictions bypass and privilege escalation.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36967)
The vulnerability allows a remote attacker on the local network to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows WLAN AutoConfig Service, which leads to security restrictions bypass and privilege escalation.
5) Information disclosure (CVE-ID: CVE-2021-36969)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Redirected Drive Buffering SubSystem Driver. A local user can gain unauthorized access to sensitive information on the system.
6) Spoofing attack (CVE-ID: CVE-2021-36970)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Windows Print Spooler. A remote attacker can spoof page content.
7) Information disclosure (CVE-ID: CVE-2021-36972)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows SMB. A local user can gain unauthorized access to sensitive information on the system.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36973)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Redirected Drive Buffering System, which leads to security restrictions bypass and privilege escalation.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36974)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows SMB, which leads to security restrictions bypass and privilege escalation.
10) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36975)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Win32k, which leads to security restrictions bypass and privilege escalation.
11) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38628)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Ancillary Function Driver for WinSock, which leads to security restrictions bypass and privilege escalation.
12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36963)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
13) Information disclosure (CVE-ID: CVE-2021-38629)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Ancillary Function Driver for WinSock. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.
14) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38630)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.
15) Security features bypass (CVE-ID: CVE-2021-38632)
The vulnerability allows a local attacker to bypass authentication process.
The vulnerability exists due to security feature bypass issue in BitLocker. An attacker with physical access can bypass the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data.
16) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38633)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
17) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38634)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Microsoft Windows Update Client, which leads to security restrictions bypass and privilege escalation.
18) Information disclosure (CVE-ID: CVE-2021-38635)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Redirected Drive Buffering SubSystem Driver. A local user can gain unauthorized access to sensitive information on the system.
19) Information disclosure (CVE-ID: CVE-2021-38636)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Redirected Drive Buffering SubSystem Driver. A local user can gain unauthorized access to sensitive information on the system.
20) Information disclosure (CVE-ID: CVE-2021-38637)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Storage. A local user can gain unauthorized access to sensitive information on the system.
21) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38638)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Ancillary Function Driver for WinSock, which leads to security restrictions bypass and privilege escalation.
22) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38639)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Win32k, which leads to security restrictions bypass and privilege escalation.
23) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36964)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.
24) Information disclosure (CVE-ID: CVE-2021-36962)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Installer. A local user can gain unauthorized access to sensitive information on the system.
25) Information disclosure (CVE-ID: CVE-2021-38663)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows exFAT File System. A local user can gain unauthorized access to sensitive information on the system.
26) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-34536)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the Storage Spaces Controller, which leads to security restrictions bypass and privilege escalation.
27) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-26426)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the User Account Profile Picture, which leads to security restrictions bypass and privilege escalation.
28) Code Injection (CVE-ID: CVE-2021-26432)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
29) Information disclosure (CVE-ID: CVE-2021-26433)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can gain unauthorized access to sensitive information on the system.
30) Buffer overflow (CVE-ID: CVE-2021-26435)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Windows Scripting Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
31) Integer overflow (CVE-ID: CVE-2021-26441)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to integer overflow within the Storage Spaces Controller storport.sys driver. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with SYSTEM privileges.
32) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-26442)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows HTTP.sys, which leads to security restrictions bypass and privilege escalation.
33) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-34486)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.
34) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-34487)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.
35) Code Injection (CVE-ID: CVE-2021-34530)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Windows Graphics Component. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
36) Code Injection (CVE-ID: CVE-2021-34534)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Windows MSHTML Platform. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
37) Information disclosure (CVE-ID: CVE-2021-36926)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can gain unauthorized access to sensitive information on the system.
38) Input validation error (CVE-ID: CVE-2021-36961)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows Installer. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
39) Information disclosure (CVE-ID: CVE-2021-36932)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can gain unauthorized access to sensitive information on the system.
40) Information disclosure (CVE-ID: CVE-2021-36933)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can gain unauthorized access to sensitive information on the system.
41) Information disclosure (CVE-ID: CVE-2021-36938)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Cryptographic Primitives Library. A local user can gain unauthorized access to sensitive information on the system.
42) Buffer overflow (CVE-ID: CVE-2021-36948)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Windows Update Medic Service. A local user can run a specially crafted program to execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
43) Input validation error (CVE-ID: CVE-2021-36953)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows TCP/IP. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
44) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36954)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Bind Filter Driver, which leads to security restrictions bypass and privilege escalation.
45) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-36955)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
46) Incorrect permission assignment for critical resource (CVE-ID: CVE-2021-36958)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists in Windows Print Spooler service due to improperly performed privileged file operations. A local user can send a specially crafted request to the Print Spooler service and execute arbitrary code with SYSTEM privileges.
47) Spoofing attack (CVE-ID: CVE-2021-36959)
The vulnerability allows a local user to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Windows Authenticode. A local user can spoof page content.
48) Information disclosure (CVE-ID: CVE-2021-36960)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows SMB. A remote attacker can gain unauthorized access to sensitive information on the system.
49) Information disclosure (CVE-ID: CVE-2021-38662)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Fast FAT File System Driver. A local user can gain unauthorized access to sensitive information on the system.
50) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38667)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.
51) Improper input validation (CVE-ID: CVE-2021-35559)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Swing component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
52) Code Injection (CVE-ID: CVE-2021-41340)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows Graphics Component. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
53) Code Injection (CVE-ID: CVE-2021-41342)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows MSHTML Platform. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
54) Information disclosure (CVE-ID: CVE-2021-41343)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Fast FAT File System Driver. A local user can gain unauthorized access to sensitive information on the system.
55) Integer overflow (CVE-ID: CVE-2021-41345)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to integer overflow within the Storage Spaces Controller storport.sys driver. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with SYSTEM privileges.
56) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-41347)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows AppX Deployment Service, which leads to security restrictions bypass and privilege escalation.
57) Incorrect Regular Expression (CVE-ID: CVE-2021-27290)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect processing of SRIs. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.
58) Out-of-bounds write (CVE-ID: CVE-2021-3517)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in the xml entity encoding functionality. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.
59) Improper input validation (CVE-ID: CVE-2021-3522)
The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the JavaFX (GStreamer) component in Java SE. A local non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
60) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2021-35550)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to the JSSE component in Oracle GraalVM Enterprise Edition offers cipher suites in the wrong way, which causes weaker cipher suites to be offered ahead of the strong ones. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
61) Improper input validation (CVE-ID: CVE-2021-35556)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Swing component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
62) Improper input validation (CVE-ID: CVE-2021-35560)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Deployment component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
63) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-41335)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Kernel, which leads to security restrictions bypass and privilege escalation.
64) Improper input validation (CVE-ID: CVE-2021-35561)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Utility component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
65) Improper input validation (CVE-ID: CVE-2021-35564)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Keytool component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
66) Improper input validation (CVE-ID: CVE-2021-35565)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
67) Improper input validation (CVE-ID: CVE-2021-35567)
The vulnerability allows a remote authenticated user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.
68) Improper input validation (CVE-ID: CVE-2021-35578)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition when processing TLS 1.3 ClientHello packets. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
69) Improper input validation (CVE-ID: CVE-2021-35586)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
70) Improper input validation (CVE-ID: CVE-2021-35588)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
71) Improper input validation (CVE-ID: CVE-2021-35603)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
72) Incorrect Resource Transfer Between Spheres (CVE-ID: CVE-2021-36338)
The vulnerability allows a remote attacker on a local network to gain elevated privileges.The vulnerability exists due to incorrect resource transfer between spheres. A remote attacker on a local network can escalate their privileges and access functionalities they do not have access to.
73) Security features bypass (CVE-ID: CVE-2021-41338)
The vulnerability allows a local user to bypass authentication process.
The vulnerability exists due to security feature bypass issue in Windows AppContainer Firewall Rules. A local user can gain access to encrypted data.
74) Information disclosure (CVE-ID: CVE-2021-41332)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Print Spooler. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.
75) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-38671)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.
76) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40464)
The vulnerability allows a remote authenticated attacker on the local network to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Nearby Sharing, which leads to security restrictions bypass and privilege escalation.
77) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40443)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
78) Code Injection (CVE-ID: CVE-2021-40444)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the MSHTML component. A remote attacker can create a specially crafted Office document with a malicious ActiveX control inside, trick the victim into opening the document and execute arbitrary code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
79) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40447)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.
80) Use-after-free (CVE-ID: CVE-2021-40449)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to a boundary error within the Win32k NtGdiResetDC function in Microsoft Windows kernel. A local user can run a specially crafted program to trigger a use-after-free error, when the function ResetDC is executed a second time for the same handle during execution of its own callback, and execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
81) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40450)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Win32k, which leads to security restrictions bypass and privilege escalation.
82) Information disclosure (CVE-ID: CVE-2021-40454)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Rich Text Edit Control. A local user can gain unauthorized access to sensitive information on the system.
83) Spoofing attack (CVE-ID: CVE-2021-40455)
The vulnerability allows a local user to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Windows Installer. A local user can spoof page content.
84) Security features bypass (CVE-ID: CVE-2021-40460)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to security feature bypass issue in Windows Remote Procedure Call Runtime. A remote authenticated attacker can bypass the target application
85) Code Injection (CVE-ID: CVE-2021-40462)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows Media Foundation Dolby Digital Atmos Decoders. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
86) Input validation error (CVE-ID: CVE-2021-40463)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in Windows NAT. A remote authenticated attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
87) Code Injection (CVE-ID: CVE-2021-40465)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows Text Shaping. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
88) Code Injection (CVE-ID: CVE-2021-41331)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Windows Media Audio Decoder. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
89) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40466)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
90) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40467)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.
91) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40470)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in DirectX Graphics Kernel, which leads to security restrictions bypass and privilege escalation.
92) Information disclosure (CVE-ID: CVE-2021-40475)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Cloud Files Mini Filter Driver. A local user can gain unauthorized access to sensitive information on the system.
93) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40476)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows AppContainer, which leads to security restrictions bypass and privilege escalation.
94) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-40477)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.
95) Integer overflow (CVE-ID: CVE-2021-40478)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to integer overflow within the Storage Spaces Controller storport.sys driver. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with SYSTEM privileges.
96) Integer overflow (CVE-ID: CVE-2021-40488)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to integer overflow within the Storage Spaces Controller storport.sys driver. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with SYSTEM privileges.
97) Integer overflow (CVE-ID: CVE-2021-40489)
The vulnerability allows a local user to escalate privileges on the system.The vulnerability exists due to integer overflow within the Storage Spaces Controller storport.sys driver. A local user can run a specially crafted program to trigger integer overflow and execute arbitrary code with SYSTEM privileges.
98) Code Injection (CVE-ID: CVE-2021-41330)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in Microsoft Windows Media Foundation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.