CVE-2023-33174
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in Windows allows for the disclosure of cryptographic information. This may lead to unauthorized access to sensitive data.
Risk Assessment
Organizations may be exposed to the leakage of confidential information, potentially leading to serious security breaches.
Recommendation
It is recommended to update Windows to the latest version to patch this vulnerability.
Other vulnerabilities in Windows
See all- CVE-2017-0166High
A privilege escalation vulnerability exists in Windows due to improper calculation of LDAP request buffer lengths. An attacker could exploit this vulnerability by sending malicious traffic to a Domain Controller using a specially crafted application.
- CVE-2023-45284Medium
The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.
- CVE-2024-38217MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2023-36584MediumActively exploited
Security Feature Bypass vulnerability in Windows Mark of the Web. Technical details are not available in the description.
- CVE-2022-41091MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2022-41049MediumActively exploited
Security feature bypass vulnerability in Windows Mark of the Web. It allows an attacker to bypass security protections related to files downloaded from the internet.
- CVE-2021-36934HighActively exploited
An elevation of privilege vulnerability exists due to overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker could run arbitrary code with SYSTEM privileges, install programs, view/change/delete data, or create new accounts with full user rights.
- CVE-2020-1067High
A remote code execution vulnerability in Windows due to improper handling of objects in memory. An attacker with a domain user account could exploit it by creating a specially crafted request. The update corrects how Windows handles objects in memory.
- CVE-2018-8440HighActively exploited
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- CVE-2000-0222High
The installation for Windows 2000 does not activate the Administrator password until the system has rebooted, allowing remote attackers to connect to the ADMIN$ share without a password until the reboot occurs.
Original NVD description (English source)
Windows Cryptographic Information Disclosure Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS