B33F

**Name of the Vulnerable Software and Affected Versions** EasyFTP version 1.7.0.2 **Description** A critical issue was found in the MKD Command Handler component, which can be exploited remotely. The manipulation leads to a buffer overflow. **Recommendations** For EasyFTP version 1.7.0.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 **Description** The Secondary Logon Service in Microsoft Windows does not properly process request handles, allowing local users to gain privileges via a crafted application. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator, then install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. **Recommendations** For Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511, consider disabling the Secondary Logon Service as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using crafted applications that could exploit the vulnerability in the Secondary Logon Service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.