Abdelhamid Naceri

**Name of the Vulnerable Software and Affected Versions** Razer Synapse 3 version 3.9.131.20813 Synapse 3 App version 20240213 **Description** An issue in Razer Synapse 3 allows a local attacker to execute arbitrary code via the `export` parameter of the `Chroma Effects` function in the `Profiles` component. **Recommendations** For Razer Synapse 3 version 3.9.131.20813, consider disabling the `Chroma Effects` function in the `Profiles` component until a patch is available. For Synapse 3 App version 20240213, restrict access to the `export` parameter of the `Chroma Effects` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Deep Security Agent version 20 **Description** An improper access control vulnerability could allow a local attacker to escalate privileges on affected installations. To exploit this issue, an attacker must first obtain the ability to execute low-privileged code on the target system. **Recommendations** For Trend Micro Deep Security Agent version 20, apply the necessary patch or update to fix the improper access control vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Docker Desktop versions prior to 4.41.0 **Description** A vulnerability in the update process of Docker Desktop for Windows could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:ProgramDataDockerconfig with high privileges. However, this directory often does not exist by default, and C:ProgramData allows normal users to create new directories. By creating a malicious Dockerconfig folder structure at this location, an attacker can force the privileged update process to delete or manipulate arbitrary system files, leading to Elevation of Privilege. **Recommendations** For versions prior to 4.41.0, update to version 4.41.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the C:ProgramData directory to prevent malicious folder creation until the update is applied. Avoid using the vulnerable update process until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to insufficient access control in the Win32k component of Windows operating systems, which can be exploited to elevate privileges. This allows an attacker to affect the system. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Installer (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows Installer, which can be exploited to elevate privileges. An elevation-of-privilege vulnerability allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avast Premium Security (affected versions not specified) **Description** The issue is related to insufficient access control in the isolated environment when handling namespace objects. Exploitation of this flaw can allow an attacker to escalate privileges and execute arbitrary code. The vulnerability exists within the implementation of the sandbox feature, where an attacker can create a symbolic link to abuse the service and create arbitrary namespace objects, leading to privilege escalation and arbitrary code execution in the context of SYSTEM. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Cloud Files Mini Filter Driver (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows Cloud Files Mini Filter driver, which can be exploited to elevate privileges. This allows an attacker to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Defender (affected versions not specified) **Description** The issue is related to synchronization errors when using a shared resource, specifically a "race condition" situation. This could allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Deep Security version 20.0 Trend Micro Cloud One - Endpoint and Workload Security Agent (affected versions not specified) **Description** An improper access control issue could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The vulnerability is related to insufficient access control to folders in the Anti-Malware module of the Trend Micro Deep Security Agent for Windows operating systems, which may enable an attacker to elevate their privileges and execute arbitrary code. **Recommendations** For Trend Micro Deep Security version 20.0, update to a version that includes the fix for this issue. For Trend Micro Cloud One - Endpoint and Workload Security Agent, apply the recommended configuration changes or patches as soon as they become available to address the improper access control vulnerability. As a temporary workaround, consider restricting access to sensitive folders and modules to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to insufficient input validation in the Windows operating system kernel. It allows an attacker to perform a denial-of-service (DoS) attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Kernel (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows operating system kernel, which can be exploited to bypass security restrictions and elevate privileges. This allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Defender (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in Microsoft Defender. It is caused by synchronization errors when using a shared resource in the Microsoft Malware Protection Engine module. Exploitation of this issue may allow an attacker to elevate their privileges in the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Avast Premium Security (affected versions not specified) **Description** This issue allows local attackers to escalate privileges on affected installations. The flaw exists within the implementation of the sandbox feature due to incorrect authorization, enabling an attacker to execute arbitrary code outside the sandbox at medium integrity. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) **Description** The issue is related to improper access control in the Trend Micro Apex One agent, which could allow a local attacker to gain elevated privileges. This can enable the creation of arbitrary directories with arbitrary ownership. The vulnerability is also associated with insufficient access control to the Suspect folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) **Description** A security agent link following issue could allow a local attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink, allowing privilege escalation on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The vulnerability is related to the incorrect determination of a link before accessing a file in the Browser Exploit Detection mechanism. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) **Description** The issue is related to a link following vulnerability in the scanning function of the Trend Micro Apex One agent. This could allow a local attacker to escalate privileges on affected installations. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability is also associated with incorrect link resolution before accessing a file in the Apex One NT RealTime Scan service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) Trend Micro Apex One as a Service (affected versions not specified) **Description** A link following vulnerability in the Damage Cleanup Engine component could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. **Recommendations** For Trend Micro Apex One, consider restricting access to the Damage Cleanup Engine component until a patch is available. For Trend Micro Apex One as a Service, consider disabling the Damage Cleanup Engine component temporarily to minimize the risk of exploitation. As a temporary workaround, avoid using the Damage Cleanup Engine component in situations where low-privileged code execution is possible, until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) Trend Micro Apex One as a Service (affected versions not specified) **Description** The issue is related to an improper handling of exceptional conditions, which could allow a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system. **Recommendations** For Trend Micro Apex One, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Trend Micro Apex One as a Service, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Apex One (affected versions not specified) **Description** A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro Deep Security version 20 Cloud One - Workload Security Agent for Windows (affected versions not specified) **Description** A link following issue could allow a local attacker to escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. **Recommendations** For Trend Micro Deep Security version 20, update to a version that includes a fix for this issue. For Cloud One - Workload Security Agent for Windows, apply the recommended configuration changes or patches as soon as they become available to prevent privilege escalation. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.