Filip Dragović

**Name of the Vulnerable Software and Affected Versions** Microsoft Management Console (affected versions not specified) **Description** Improper access control in the Microsoft Management Console allows an authorized attacker to elevate privileges locally, which can enable them to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Host Process for Windows Tasks (affected versions not specified) **Description** An issue with how links are handled before accessing files ('link following') in Host Process for Windows Tasks can allow a local attacker with authorization to gain higher privileges on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Azure Network Watcher VM Extension (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Azure Network Watcher VM Extension. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Event Tracing (affected versions not specified) **Description** The issue is related to a denial of service vulnerability in Windows Event Tracing. It is caused by incorrect handling of symbolic links before accessing a file. Exploitation of this issue can allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio (affected versions not specified) Description: The issue is related to insufficient access control in Microsoft Visual Studio, which can be exploited by a remote attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in Windows Storage. It allows attackers to affect the system by exploiting errors in symbolic link handling, potentially enabling them to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Network Watcher VM Agent (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to July 8, 2025 **Description** An improper link resolution vulnerability exists in the Windows Update Service before file access. This allows an authorized attacker to elevate privileges locally. The vulnerability affects Windows 10 and Windows 11 clients with at least two hard drives. The `wuauserv` service is involved, and the vulnerability relates to incorrect handling of symbolic links during file access, potentially enabling arbitrary file deletion and privilege escalation. **Recommendations** Update your systems to the latest version available before July 8, 2025, to address this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Connected Machine Agent (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Azure Connected Machine Agent. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Connected Machine Agent (affected versions not specified) **Description** The issue is related to an Elevation of Privilege Vulnerability in the Azure Connected Machine Agent. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio (affected versions not specified) **Description** The issue is related to inadequate access control in Microsoft Visual Studio, allowing a remote attacker to elevate their privileges using a specially crafted extension. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Monitor Agent (affected versions not specified) **Description** The issue is related to an incorrect reference count before accessing a file, which can be exploited to elevate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Windows Authentication component of Windows operating systems. It is caused by incorrect link resolution before accessing a file. Exploitation of this issue may allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Monitor Agent (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Azure Monitor Agent, which is used for data collection from virtual machines (VM) and physical servers. The vulnerability is caused by an incorrect reference definition before accessing a file. Exploitation of this issue may allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xbox Gaming Services (affected versions not specified) **Description** The issue concerns an elevation of privilege vulnerability in Xbox Gaming Services, allowing for the gain of SYSTEM privileges. There have been public disclosures and discussions about this issue, with Microsoft initially stating it was not a security issue before later patching the vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Windows Update Stack, which is associated with insufficient access control. This vulnerability can be exploited to allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in Microsoft Visual Studio, which could allow an attacker to gain elevated privileges on affected systems. The vulnerability is associated with the VSStandardCollectorService150 service. There is evidence of a proof-of-concept (PoC) exploit code being available. The vulnerability could be exploited by a threat actor to gain elevated privileges on affected systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to insufficient access restrictions in the Local Security Authority Subsystem Service, which can be exploited to elevate privileges. This allows an attacker to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a component of Windows Authentication and is associated with inadequate access control. Exploitation of this issue may allow an attacker to elevate their privileges. There is an elevation-of-privilege vulnerability that allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Click-To-Run (affected versions not specified) **Description** The issue is related to insufficient access restrictions in the Click-to-Run (C2R) component of Microsoft Office and Office 365. Exploitation of this issue may allow an attacker to elevate their privileges using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.