Ma7H1As

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 84.0.4147.89 **Description** A policy bypass issue in the Content Security Policy (CSP) component of Google Chrome allowed a remote attacker to bypass content security policy via a crafted HTML page. The vulnerability is related to incorrect access control, which could allow a remote attacker to impact data integrity. It is estimated that almost every website in the world was at risk due to this issue. The vulnerability could potentially expose passwords in plain text through the user interface or in local files. **Recommendations** For Google Chrome versions prior to 84.0.4147.89, update to version 84.0.4147.89 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and avoiding the use of plain text passwords in local files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the "Public Account Pictures" folder, which improperly handles junctions. To exploit this, an attacker must first gain execution on the victim system. This allows the attacker to potentially elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Malicious Software Removal Tool (MSRT) (affected versions not specified) **Description** An elevation of privilege issue exists due to the Windows Malicious Software Removal Tool (MSRT) improperly handling junctions. To exploit this, an attacker must first gain execution on the victim system. The vulnerability can be exploited by a specially crafted application, allowing an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows User Profile Service (ProfSvc) (affected versions not specified) **Description** The issue is related to the improper handling of symlinks by the Windows User Profile Service, which can allow an attacker to elevate their privileges. This can potentially affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue is related to insufficient input validation in the Chromium browser's user interface, which can be exploited by a remote attacker using a specially crafted HTML page. This can lead to data integrity violations. The problem is described as UI spoofing, allowing an attacker to spoof notifications. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied. Avoid using the browser for sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue is related to insufficient policy enforcement in Chromium, allowing a remote attacker to perform domain spoofing via a crafted HTML page. This can potentially disrupt data integrity by exploiting the vulnerability with a specially crafted HTML page. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue concerns a UI spoofing problem in Chromium, which is part of Google Chrome. It allows a remote attacker to spoof notifications by using a crafted HTML page. The vulnerability is related to insufficient input validation, potentially enabling a remote attacker to compromise data integrity via a specially crafted HTML page. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer (affected versions not specified) **Description** A spoofing issue arises due to Internet Explorer's improper handling of URLs. This could allow a remote attacker to redirect a user to a specially crafted website, potentially spoofing content or serving as a pivot to chain an attack with other vulnerabilities in web services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to errors in handling hard links in the Windows AppX Deployment Service (AppXSVC), which can be exploited by an attacker to elevate their privileges using a specially crafted application. An elevation-of-privilege vulnerability allows attackers to affect the system. There have been reports of a bypass for the recent Windows patch, with a second zero-day exploit disclosed that apparently bypasses Microsoft's patch for a Windows Elevation of Privilege (EoP) vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.