Naor Hodorov

**Name of the Vulnerable Software and Affected Versions** Windows SDK (affected versions not specified) **Description** The issue is related to improper access control in the Windows SDK, allowing an authorized attacker to elevate privileges locally. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visual Studio Collector Service (affected versions not specified) **Description** The issue is related to an incorrect reference resolution before accessing a file, which can lead to a denial of service. An attacker could exploit this to cause a service disruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** G DATA Total Security (affected versions not specified) **Description** This issue allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the G DATA AntiVirus Scan Server. By creating a symbolic link, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** AnyDesk versions prior to 9.0.1 **Description** This issue allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read arbitrary files. An attacker can leverage this issue to disclose stored credentials, leading to further compromise. Over 13,000 services are potentially affected. **Recommendations** AnyDesk versions prior to 9.0.1: Update to version 9.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the background image handling functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Avast Antivirus versions prior to 24.2 Description: A vulnerability exists within the "Repair" feature of Avast Antivirus, which attempts to delete a file in the current user's AppData directory as NT AUTHORITYSYSTEM. A low-privileged user can create a pseudo-symlink and a junction folder, pointing to a file on the system, allowing them to elevate their privilege and potentially delete arbitrary files or run processes as NT AUTHORITYSYSTEM. This can be achieved by exploiting a race-condition, which can lead to the recreation of system files and allow the execution of a specially-crafted file, potentially launching a privileged shell instance. Recommendations: For Avast Antivirus versions prior to 24.2, update to version 24.2 or later to resolve the issue. As a temporary workaround, consider disabling the "Repair" feature in the settings until the update is applied. Restrict access to the AppData directory to minimize the risk of exploitation. Avoid using the "Repair" function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.16 **Description** The issue is related to errors in processing input data in the Core component of Oracle VM VirtualBox. This can be exploited by an attacker to elevate privileges or execute arbitrary code by manipulating log files. The vulnerability applies to Windows hosts only and can result in the takeover of Oracle VM VirtualBox. Successful attacks can compromise the confidentiality, integrity, and availability of the system. **Recommendations** For Oracle VM VirtualBox versions prior to 7.0.16, update to version 7.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component or limiting the ability to manipulate log files in the C:ProgramDataVirtualBox directory to minimize the risk of exploitation.