CVE-2016-6716

An elevation of privilege vulnerability in the AOSP Launcher in Android 7.0 before 2016-11-01 could allow a local malicious application to create shortcuts that have elevated privileges without the user's consent. This issue is rated as Moderate because it is a local bypass of user interaction...

Palo Alto Networks PAN-OS Local Elevation of Privilege Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A local elevation of privilege vulnerability exists in Palo Alto Networks PAN-OS. A local attacker can exploit this vulnerability to gain privileges with specially crafted environme...

Pacemaker Local Elevation of Privilege Vulnerability

Pacemaker is a cluster resource manager that provides fault detection, cluster services, etc. via a preferred cluster infrastructure OpenAIS or Heartbeat. A local elevation of privilege vulnerability exists in Pacemaker versions 1.1.10 through 1.1.15, which can be exploited by an attacker to gain...

CVE-2016-7216

The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandles permissions, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Elevation of Privilege Vulnerability."...

GPU Display Driver Local Elevation of Privilege Vulnerability in Multiple NVIDIA Products

NVIDIA Quadro, NVS, and GeForce are all graphics card products from NVIDIA Corporation.NVIDIA Windows GPU Display Driver is one of the graphics processor GPU graphics card drivers dedicated to Windows. A local elevation of privilege vulnerability exists in the GPU Display Driver for multiple NVID...

CVE-2016-3342: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Common Log File System CLFS driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to gain privileges via a crafted...

CVE-2016-7226: Improper Access Control

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."...

NVIDIA Windows GPU Display Driver Local Elevation of Privilege Vulnerability (CNVD-2016-10567)

NVIDIA Windows GPU Display Driver is a set of graphics processor GPU graphics card drivers for Windows from NVIDIA. A local elevation of privilege vulnerability exists in NVIDIA Windows GPU Display Driver, which arises from the program failing to properly validate values. A local attacker could...

Adobe Creative Cloud Local Privilege Vulnerability

Adobe Creatie Cloud Desktop is a suite of applications for managing applications and services in the Creative Cloud Membership Management Center from Adobe USA. The program supports synchronizing and sharing files, managing fonts, and accessing asset libraries for commercial photography and desig...

Return to libstagefright: exploiting libutils on Android

Posted by Mark Brand, Invalidator of Unic�o�d�e I’ve been investigating different fuzzing approaches on some Android devices recently, and this turned up the following rather interesting bug CVE 2016-3861 fixed in the most recent Android Security Bulletin, deep in the bowels of the usermode Andro...

AVG Internet Security avgtdix.sys Elevation of Privilege Vulnerability

AVG Internet Security is anti-virus protection software. AVG Internet Security is implemented with a local elevation of privilege vulnerability in the handling of 0x534a600c IOCTL within the avgtdix driver and 0x53606148 IOCTL within the avgidsdriverx driver. An attacker can exploit this...

Lenovo XClarity Administrator Local Lift Vulnerability

Lenovo XClarity Administrator is a centralized resource management solution from Lenovo in China. A local elevation of privileges vulnerability exists in Lenovo XClarity Administrator versions prior to 1.1.1. A local attacker can exploit this vulnerability to gain administrator privileges...

Multiple Apple Products IOHIDFamily Local Elevation of Privilege Vulnerability

Apple iOS is an operating system developed for mobile devices; OS X is a specialized operating system developed for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. A security vulnerability in IOHIDFamily in several Apple products allows a local...

GE Proficy HMI SCADA CIMPLICITY Local Privilege Vulnerability

GE Proficy HMI SCADA CIMPLICITY is a client/server based HMI/SCADA solution. A security vulnerability exists in GE Proficy HMI SCADA CIMPLICITY that allows a local attacker to exploit the vulnerability to elevate privileges...

Lenovo Solution Center Local Elevation of Privilege Vulnerability

Lenovo Solution Center LSC is a suite of software from the Chinese company Lenovo that helps users quickly identify the state of system health, network connectivity and overall system security. A local elevation of privilege vulnerability exists in versions prior to LSC 3.3.003. A local attacker...

PT-2016-3132

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Description The issue is related to insufficient validation of handles in the Windows operating system. This could allow a...

Comodo Anti-Virus - SHFolder.dll Local Privilege Elevation Exploit

Exploit for windows platform in category local exploits SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @LaughingMantis Greg Linares Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: Technical Geeky Stuff GeekBuddy stores...

VMware vCenter Server Patch Reissue

VMware on Saturday reissued a patch from October that incompletely addressed a critically rated remote code execution vulnerability in vCenter Server. The original vulnerability, CVE-2015-2342, was a poorly configured JMX RMI service in vCenter Server that was remotely accessible. The flaw allowe...

CVE-2016-0006: Undefined Security Weakness

The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a...

Lenovo Solution Center 'LSCTaskService' Local Lift Vulnerability

Lenovo Solution Center is a suite of software from the Chinese company Lenovo that helps users quickly identify the state of system health, network connectivity and overall system security. A local elevation of privilege vulnerability exists in Lenovo Solution Center. A local attacker can exploit...