206 matches found
LeakedHandlesFinder - Leaked Windows Processes Handles Identification Tool
Leaked Windows processes handles identification tool. Useful for identify new LPE vulnerabilities during a pentest or simply as a new research process. Currently supports exploiting autopwn procesess leaked handles spawning a new arbitrary process cmd.exe default. LHF identifies in realtime...
Slackware: Security Advisory (SSA:2018-142-03)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Metasploit Wrap-Up
Windows Local Privilege Escalation for standard users In this week’s release, we have an exciting new module that has been added by our very own Grant Willcox which exploits CVE-2022-26904, and allows for normal users to execute code as NT AUTHORITY/SYSTEM on Windows machines from Windows 7 up to...
UltraVNC has an unspecified vulnerability
UltraVNC is an open source remote terminal control software for the Windows platform. versions of UltraVNC prior to 1.3.8.0 have a security vulnerability in the DSM plug-in that can be exploited by a locally authenticated attacker to achieve Local Elevation of Privilege LPE on vulnerable systems...
CVE-2022-24750
UltraVNC (.3) DSM plugin local privilege escalation affects versions prior to 1.3.8.0. The DSM plugin module in UltraVNC can be exploited by a locally authenticated user to achieve LPE on vulnerable systems. The vulnerability was fixed by enabling loading of plugins from the installed directory,...
CVE-2022-24750 Low privilege user is able to exploit the service and gain SYSTEM privileges in UltraVNC server
UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation LPE on a vulnerable system. The vulnerability has been fixed to...
Update now! Microsoft patches three zero-day vulnerabilities on Patch Tuesday
The updates for Microsofts March 2022 Patch Tuesday should fix 92 vulnerabilities, including three zero-day vulnerabilities. Of the 92 vulnerabilities, 21 are for Microsoft Edge and originate from the Chromium Project. Of the 71 others, three are classified as Critical because they allow remote...
Patch Tuesday - March 2022
Microsoft's March 2022 updates include fixes for 92 CVEs including 21 from the Chromium project, which is used by their Edge web browser. None of them have been seen exploited in the wild, but three have been previously disclosed. CVE-2022-24512, affecting .NET and Visual Studio, and...
CVE-2021-37852 LPE in ESET products for Windows
ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM...
Exploit for Out-of-bounds Write in Polkit_Project Polkit
PwnKit-go-LPE CVE-2021-4034 A golang based exp for CVE-2021...
Privilege escalation
Micro-Star International MSI Center Pro = 2.0.16.0 is vulnerable to multiple Privilege Escalation LPE/EoP vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLibX64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending...
Privilege escalation
Micro-Star International MSI Dragon Center = 2.0.116.0 is vulnerable to multiple Privilege Escalation LPE/EoP vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLibX64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by...
Privilege escalation
Micro-Star International MSI App Player = 4.280.1.6309 is vulnerable to multiple Privilege Escalation LPE/EoP vulnerabilities in the NTIOLibX64.sys and BstkDrvmsi2.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests...
CVE-2021-44903
CVE-2021-44903 affects Micro-Star International (MSI) Center Pro <= 2.0.16.0. The vulnerability set comprises multiple Privilege Escalation (LPE/EoP) flaws in driver components: atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, and WinRing0x64.sys. All flaws a...
CVE-2021-44901
MSI Dragon Center
CVE-2021-44901
Micro-Star International MSI Dragon Center = 2.0.116.0 is vulnerable to multiple Privilege Escalation LPE/EoP vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLibX64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by...
CVE-2021-44900
MSI App Player
Exploit for Out-of-bounds Write in Microsoft
CVE-2022-21882 win32k LPE bypass CVE-2021-1732 Test - only...