A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.