Ruben Enkaoua

**Name of the Vulnerable Software and Affected Versions** Windows Admin Center (affected versions not specified) **Description** Improper neutralization of input during web page generation leads to cross-site scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites. An unauthorized attacker can craft a malicious gateway URL that triggers a response-based XSS within the error handling of the software. When visited by a privileged Azure administrator, this allows JavaScript execution under the software origin. This can lead to arbitrary PowerShell execution on every managed server the victim has access to without requiring credentials. In on-premises deployments, this chain enables the theft of Azure access and refresh tokens from local storage, allowing for full tenant impersonation and lateral movement into EntraID and Azure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Shell (affected versions not specified) **Description** A flaw exists in Windows Shell that could allow an attacker to perform spoofing over a network, potentially leading to unauthorized access to sensitive information. This issue enables an attacker to impersonate legitimate users or systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions (affected versions not specified) **Description** This issue involves a security flaw in Windows File Explorer that allows an attacker to extract NTLM hashes without user interaction, even on systems with the latest security patches applied. The vulnerability stems from insufficient protection of service data when processing NTLM hashes. An attacker can exploit this by creating a specially crafted LNK file, triggering NTLM authentication requests automatically. This enables potential offline cracking or relay attacks to gain unauthorized access. The vulnerability allows for spoofing over a network and impacts the system's security. The issue is a patch bypass, meaning existing mitigations are circumvented. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.