High WID-SEC-2023-3137 25 CVEs

Microsoft Windows: Mehrere Schwachstellen

Published Dec 12, 2023 · Updated Feb 15, 2024 · Revision 3 · de-DE

Vendor: Hitachi Vendor: Microsoft Product: Storage Product: Windows 10 Product: Windows 11 Product: Windows Server Product: Windows Server 2012 Product: Windows Server 2012 R2 Product: Windows Server 2016 Product: Windows Server 2019 Product: Windows Server 2022 Platform: Windows

Summary

Ein lokaler oder entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Versionen von Microsoft Windows und Microsoft Windows Server ausnutzen, um Informationen zu fälschen oder offenzulegen, um einen Denial of Service Zustand herbeizuführen, um Code auszuführen und um Systemrechte zu erlangen.

Product

Windows ist ein Betriebssystem von Microsoft.

Vulnerabilities 25

High 8.8

CVE-2023-35630

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 8.8

CVE-2023-35639

Microsoft ODBC Driver Remote Code Execution Vulnerability

Microsoft ODBC Driver Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 8.8

CVE-2023-35641

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 8.8

CVE-2023-36006

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 8.1

CVE-2023-35628 EPSS 93%

Windows MSHTML Platform Remote Code Execution Vulnerability

Windows MSHTML Platform Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 8.0

CVE-2023-35634

Windows Bluetooth Driver Remote Code Execution Vulnerability

Windows Bluetooth Driver Remote Code Execution Vulnerability

Microsoft Windows 11 version 23H2 Windows 11 version 22H2 Windows 11 version 21H2 Windows

Dec 12, 2023
High 7.8

CVE-2023-21740

Windows Media Remote Code Execution Vulnerability

Windows Media Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.8

CVE-2023-35631

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows 11 version 23H2 Windows 11 version 22H2 Windows Server 2022, 23H2 Edition (Server Core installation) Windows

Dec 12, 2023
High 7.8

CVE-2023-35632

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.8

CVE-2023-35633

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Microsoft Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 Windows

Dec 12, 2023
High 7.8

CVE-2023-35644

Windows Sysmain Service Elevation of Privilege Vulnerability

Windows Sysmain Service Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.8

CVE-2023-36011

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.8

CVE-2023-36391

Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

Microsoft Windows 11 version 23H2 Windows 11 version 22H3 Windows

Dec 12, 2023
High 7.8

CVE-2023-36696

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.5

CVE-2023-35622

Windows DNS Spoofing Vulnerability

Windows DNS Spoofing Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Dec 12, 2023
High 7.5

CVE-2023-35638

DHCP Server Service Denial of Service Vulnerability

DHCP Server Service Denial of Service Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Dec 12, 2023
High 7.5

CVE-2023-35643

DHCP Server Service Information Disclosure Vulnerability

DHCP Server Service Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Dec 12, 2023
High 7.5

CVE-2023-36004

Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability

Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
High 7.5

CVE-2023-36005 EPSS 24%

Windows Telephony Server Elevation of Privilege Vulnerability

Windows Telephony Server Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
Medium 6.8

CVE-2023-35629

Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability

Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability

Microsoft Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 Windows

Dec 12, 2023
Medium 6.7

CVE-2023-36003 Public exploit

XAML Diagnostics Elevation of Privilege Vulnerability

XAML Diagnostics Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
Medium 6.5

CVE-2023-35642

Internet Connection Sharing (ICS) Denial of Service Vulnerability

Internet Connection Sharing (ICS) Denial of Service Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 12, 2023
Medium 5.5

CVE-2023-35635

Windows Kernel Denial of Service Vulnerability

Windows Kernel Denial of Service Vulnerability

Microsoft Windows 11 version 23H2 Windows 11 version 22H2 Windows 11 version 22H3 Windows

Dec 12, 2023
Medium 5.3

CVE-2023-36012

DHCP Server Service Information Disclosure Vulnerability

DHCP Server Service Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Dec 12, 2023
Unscored —

CVE-2023-20588 EPSS 11%

Speculative Leaks

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.

AMD Athlon™ 3000 Series Processors with Radeon™ Graphics Ryzen™ PRO 3000 Series Processors with Radeon™ Vega Graphics Athlon™ PRO 3000 Series Processors with Radeon™ Vega Graphics Debian Ubuntu Alpine

Aug 8, 2023

Revision history

2024-02-15 #3
Neue Updates von HITACHI aufgenommen
2024-01-14 #2
PoC aufgenommen
2023-12-12 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates vom 2023-12-12
https://msrc.microsoft.com/update-guide
m417z / blog vom 2024-01-14
https://m417z.com/Privilege-escalation-using-the-XAML-diagnostics-API-CVE-2023-36003/
Hitachi Vulnerability Information HITACHI-SEC-2023-312 vom 2024-02-16
https://www.hitachi.com/products/it/storage-solutions/sec_info/2023/12.html