MiniPlasma

MiniPlasma CVE-2020-17103 据说仍然有效...

MiniPlasma-Runner

MiniPlasma-Runner 修改自 Nightmare-Eclipse/MiniPlasma（CVE-2020-17103）的版本，适配 C2 使用。 原始 PoC 仅从磁盘运行。此版本通过执行程序集完全在内存中运行，采用拆分二进制方法以避免检测。 免责声明 本工具仅用于授权安全测试和教育目的。在未获得明确书面许可的情况下使用本工具攻击系统是非法且不道德的。作者不对因使用本工具而导致的滥用或损害承担责任。进行任何安全测试前请务必获得适当授权。 变更内容 将多进程阶段重构为单进程线程执行（不再通过 Assembly.Location 自行重启动） 移除了会终止宿主进程的...

miniplasma-advisory

MiniPlasma - 漏洞防护公告 针对影响 Windows 云文件迷你筛选器驱动程序 cldflt.sys 的 CVE-2020-17103 MiniPlasma 变体的技术缓解公告。 作者：Rafael França - 微软网络安全架构师 CSA，客户成功事业部 CSU。 下载防护公告 PDF...

MiniPlasma-Detection

MiniPlasma 检测 CVE-2020-17103 针对 MiniPlasma 的 Sigma 检测规则，这是一个利用 cldflt.sys 中竞争条件的 Windows 本地特权提升漏洞利用程序，通过劫持 SYSTEM 账户的 windir 环境变量，将 WER QueueReporting 计划任务重定向到执行攻击者控制的二进制程序（以 SYSTEM 身份运行）。 CVE-2020-17103 最初由 Google Project Zero 的 James Forshaw 于 2020 年报告，微软据称已修复。截至 2026 年 5 月，该漏洞在完全补丁的 Windows 11...

Windows Cloud Files Mini Filter Driver EoP (MiniPlasma) (Direct Check) (CVE-2020-17103)

Binary data windowsminiplasmaCVE-2020-17103.nbin...

VulnCheck KEV: CVE-2020-17103

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability...

Exploit for Improper Privilege Management in Microsoft

MiniPlasma Detection CVE-2020-17103 Sigma detection rule fo...

CVE-2020-17103

creationtimestamp| type| source ---|---|--- 2026-05-15 03:00:06+00:00| published-proof-of-concept| Telegram/4tIKexrP1B7eYtOW91-QaKQ8EIqNMri3pu2CJIQ1mA899I 2026-05-16 09:09:16+00:00| seen| https://t.me/P0x3k1N73LL1G3NC3/354 2026-05-16 09:41:16+00:00| seen|...

CVE-2020-17103 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

...

CVE-2020-17103

CVE-2020-17103 concerns the Windows Cloud Files Mini Filter Driver (cldflt.sys). Public materials describe a local privilege escalation via a race condition in the mini-filter that can hijack the windir environment path and redirect operations, enabling SYSTEM-level access under certain condition...

Microsoft Windows Multiple Vulnerabilities (KB4592449)

This host is missing a critical security update according to Microsoft KB4592449 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KB4592449: Windows 10 Version 1903 and Windows 10 Version 1909 December 2020 Security Update

The remote Windows host is missing security update 4592449. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-16958, CVE-2020-16959, CVE-2020-16960, CVE-2020-16961, CVE-2020-16962,...

KB4592440: Windows 10 Version 1809 and Windows Server 2019 December 2020 Security Update

The remote Windows host is missing security update 4592440. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-16958, CVE-2020-16959, CVE-2020-16960, CVE-2020-16961, CVE-2020-16962,...

KB4592438: Windows 10 Version 2004 December 2020 Security Update

The remote Windows host is missing security update 4592438. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2020-17095, CVE-2020-17096 - An memor...

KB4592446: Windows 10 Version 1803 December 2020 Security Update

The remote Windows host is missing security update 4592446. It is, therefore, affected by multiple vulnerabilities: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

CVE-2019-17103

An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...

CVE-2019-17103

CVE-2019-17103 concerns an Incorrect Default Permissions issue in the BDLDaemon component of Bitdefender AV for Mac, enabling an attacker to elevate privileges to read protected directories. Affected software: Bitdefender AV for Mac, prior to version 8.0.0. Root cause: incorrect default permissio...

CVE-2019-17103 Get-task-allow entitlement via BDLDaemon on macOS

An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...

CVE-2018-17103

An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...

CVE-2018-17103

GetSimple CMS v3.3.13 is affected by a CSRF vulnerability that can change the administrator password via admin/settings.php. The issue is evidenced in multiple sources (NVD/CVE-2018-17103, CNVD-2018-19747, OSV, CVE records). The root cause is a CSRF flaw possibly related to nonce handling, enabli...