Microsoft Security Response Center

Out-of-bounds read in TCG TPM2.0 allows an authorized attacker to disclose information locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

**According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?** Successful exploitation of this vulnerability requires an attacker to win a race condition.

Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges locally.

Use after free in Windows Resilient File System (ReFS) Deduplication Service allows an unauthorized attacker to elevate privileges locally.

Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.