On Windows, the method for allocating a context when using the CG BCrypt APIs is insecure leading to use-after-free of secure memory resulting in elevation of privilege.
@Drive version 2.8 suffers from a local file inclusion vulnerability.
Windows CG APIs, which take encrypted keys, do not limit what encryption or checksum types can be used with those keys. This can result in using weak encryption algorithms which could be abused to either generate keystreams or brute force encryption keys.
Windows Credential guard does not prevent using encrypted Kerberos keys to change a user’s password leading to elevation of privilege.
AirDisk version 7.5.5 suffers from a persistent cross site scripting vulnerability.
mbDrive Lite WiFi Flash Disk version 1.4.0 suffers from a cross site scripting vulnerability.
Online Notice Board 2022 suffers from a remote SQL injection vulnerability.
On Windows, CG API KerbIumCreateApReqAuthenticator can be used to decrypt arbitrary encrypted Kerberos keys leading to information disclosure.
On Windows, the KerbIumGetNtlmSupplementalCredential CG API does not check the encryption key type leading to information disclosure of key material.
InTouch Access Anywhere Secure Gateway versions 2020 R2 and below suffer from a path traversal vulnerability.