#windows

Windows Credential guard does not prevent using encrypted Kerberos keys to change a user's password leading to elevation of privilege.

Windows CG APIs, which take encrypted keys, do not limit what encryption or checksum types can be used with those keys. This can result in using weak encryption algorithms which could be abused to either generate keystreams or brute force encryption keys.

On Windows, the method for allocating a context when using the CG BCrypt APIs is insecure leading to use-after-free of secure memory resulting in elevation of privilege.

On Windows, a number of Kerberos CG APIs do not verify the ASN1 PDU type when decoding and encoding Kerberos ASN1 structures leading to type confusion and elevation of privilege.

The Windows kernel suffers from multiple memory problems when handling incorrectly formatted security descriptors in registry hives.

The Windows kernel suffers from an invalid read/write condition due to an unchecked Blink cell index in the root security descriptor.

The Windows kernel suffers from a use-after-free vulnerability due to a refcount overflow in the registry hive security descriptors.

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.

In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages.

By Deeba Ahmed The stealthy malware leverages security flaws to gain privilege escalation and establish persistence. This is a post from HackRead.com Read the original post: Stealthy Linux Malware Shikitega Deploying Monero Cryptominer