| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting another user's personal data to a created folder.
To exploit the vulnerability, an attacker can create a new folder under the Folder Redirection root path and create a junction on a newly created User folder. When the new user logs in, Folder Redirection would start redirecting to the folder and copying personal data.
This elevation of privilege vulnerability can only be addressed by reconfiguring Folder Redirection with Offline files and restricting permissions, and NOT via a security update for affected Windows Servers. See the FAQ section of this CVE for configuration guidance. |
| Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
| Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally. |
| Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. |
