Microsoft Windows Registry Local Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. Registry is one of the registries used to store information about system and application settings. A local elevation of privilege vulnerability exists in Microsoft Windows. A local attacker can exploi...

Microsoft Windows DirectX Graphics Kernel Local Elevation of Privilege Vulnerability (CNVD-2018-19383)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. DirectX Graphics Kernel is one of the graphics kernel drivers. A local elevation of privilege vulnerability exists in Microsoft Windows DirectX Graphics Kernel, which arises from the...

Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege

Posted by James Forshaw, Project Zero And we’re back again for another blog in my series on Windows Exploitation tricks. This time I’ll detail how I was able to exploit Issue 1550 which results in an arbitrary object directory being created by using a useful behavior of the CSRSS privileged...

Microsoft Windows Kernel 'Win32k.sys' Local Elevation of Privilege Vulnerability

Microsoft Windows 7, etc. are operating systems released by Microsoft Corporation in the U.S. Win32k is the 32-bit environment of its operating system. A local elevation of privilege vulnerability exists in Microsoft Windows Kernel 'Win32k.sys', which stems from a program's failure to properly...

Microsoft Windows DirectX Graphics Kernel Local Elevation of Privilege Vulnerability (CNVD-2018-11544)

Microsoft Windows Server 2016 and others are operating systems released by Microsoft Corporation USA.DirectX Graphics Kernel DXGKRNL is one of the graphics kernel drivers. A local elevation of privilege vulnerability exists in Microsoft Windows DirectX Graphics Kernel, which stems from the progra...

Intel Software Guard Extension Local Elevation of Privilege Vulnerability

Intel Software Guard Extensions Platform Software Component is a set of software components for the Software Guard Extensions Platform from Intel Corporation. A local elevation of privilege vulnerability exists in Intel Software Guard Extensions. A local attacker could exploit this vulnerability ...

CVE-2017-13273: Undefined Security Weakness

In xtqtaguid.c, there is a race condition due to insufficient locking. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-65853158...

CVE-2017-13247

In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead to local elevation of privileges with user execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID:...

Out-of-bounds

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-67962232...

CVE-2017-13231

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-67962232...

CVE-2017-13231

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-67962232...

CVE-2017-13231: Out-of-bounds Write

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-67962232...

Kaspersky Secure Mail Gateway Local Elevation of Privilege Vulnerability

Kaspersky Secure Mail Gateway is a suite of email security solutions from Russia's Kaspersky Lab. Kaspersky Secure Mail Gateway suffers from a security vulnerability that allows a local attacker to exploit the vulnerability by submitting special requests for elevated privileges...

CVE-2017-2740: Undefined Security Weakness

A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, 5.0, and 4.4. The vulnerability could result in a local unauthorized elevation of privilege on an HP thin client device...

CVE-2017-13181

In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. This could lead to an local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is...

CVE-2017-13216

In ashmemioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for...

Out-of-bounds

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution a...

Out-of-bounds

In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is n...

Design/Logic Flaw

In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for...

Integer overflow

In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not...