Feng Dong

**Name of the Vulnerable Software and Affected Versions** Windows Digital Media Receiver (affected versions not specified) **Description** The issue is related to synchronization errors when using a shared resource in the Windows Digital Media Receiver component of the Windows operating system. This can allow an attacker to elevate their privileges. The vulnerability enables attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Remote Access Connection Manager (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in the Windows Remote Access Connection Manager. It allows attackers to obtain sensitive information and potentially affect the system. Exploitation of this vulnerability may enable an attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft SharePoint Foundation, SharePoint Server, and SharePoint Enterprise Server (affected versions not specified) **Description** The issue is related to insufficient input validation in Microsoft SharePoint products, allowing a remote attacker to execute arbitrary code. This can be achieved through the deserialization of untrusted data. The estimated number of potentially affected devices worldwide is not available. There is no information provided about real-world incidents where this issue was exploited. Technical details about exploitation include the potential for remote code execution, but specific API endpoints, vulnerable parameters, or function names are not mentioned. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server versions 2013 through 2019 **Description** The issue is related to a remote code execution vulnerability in Microsoft Exchange Server, caused by insufficient validation of commandlet arguments. This allows a remote attacker to execute arbitrary code. There have been limited targeted attacks using this vulnerability in the wild. The vulnerability exists due to issues with the validation of cmdlet arguments, and exploitation requires authentication to a vulnerable Exchange Server. **Recommendations** For Microsoft Exchange Server versions 2013 through 2019, update to a version that includes the security updates released in November 2021 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable cmdlet arguments until a patch is available. Restrict access to the Exchange Server to minimize the risk of exploitation.