Jan-Jaap Korpershoek

**Name of the Vulnerable Software and Affected Versions** MarvinTest Solutions Hardware Access Driver versions 5.0.3.0 and before **Description** An issue in the Hardware Access Driver allows a local attacker to escalate privileges via the Hw65.sys component. **Recommendations** For versions 5.0.3.0 and before, update to version 5.0.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the Hw65.sys component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MicroWorld Technologies Inc eScan Antivirus version 4.0.0.49 **Description** A kernel handle leak issue in ProcObsrvesx.sys could allow privilege escalation for low-privileged users. **Recommendations** For version 4.0.0.49, consider updating to a newer version that addresses the kernel handle leak issue in ProcObsrvesx.sys to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Topaz Antifraud version 2.0.0.0 **Description** The `wsftprm.sys` kernel driver allows low-privileged attackers to terminate any Protected Process Light (PPL) process. This is achieved by sending a malicious IOCTL (Input/Output Control) request, which triggers the `ZwTerminateProcess()` function at the kernel level. This capability can be used to disable security software, such as Antivirus or Endpoint Detection and Response (EDR) systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visioweb.js version 1.10.6 **Description** The issue allows attackers to execute XSS on the client system through prototype pollution in Visioweb.js. This enables malicious activities on the client's system. **Recommendations** For Visioweb.js version 1.10.6, consider updating to a newer version that addresses the prototype pollution issue to prevent XSS attacks on the client system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.