CVE-2015-0054

Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."...

CVE-2015-0062

Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a process that uses the...

Microsoft Windows SeAssignPrimaryTokenPrivilege Local Elevation of Privilege Vulnerability

Microsoft Windows is a popular operating system. Microsoft Windows fails to properly verify and enforce the Impersonation level, and local users can bypass the Impersonation level security check and elevate privileges using a process that uses SeAssignPrimaryTokenPrivileg...

Microsoft Windows Kernel 'Win32k.sys' local elevation of privilege vulnerability (CNVD-2015-01105)

Microsoft Windows is a popular operating system. A security vulnerability in Microsoft Windows 'Win32k.sys' handling of in-memory objects allows local attackers to exploit the vulnerability to elevate privileges and execute arbitrary code in kernel context...

Privilege Elevation Issue Affecting Some Intel® Solid-State Drive Data Center Family for PCIe Products

Summary: A customer feature was added to the Intel® Solid-State Drive Data Center Family for PCIe, improving device management in the field. The initial implementation allowed for a potential privilege elevation. Description: A customer feature was added to the Intel® Solid-State Drive Data Cente...

EMC Documentum D2 Remote Privilege Elevation Vulnerability

EMC Documentum D2 is an enterprise document management software. A security vulnerability exists in a method in the Properties service of the EMC Documentum D2 WEB services component that allows a low-privileged D2 user to manipulate group privileges and elevate privileges. A remote attacker coul...

Arbitrary Write Privilege Elevation Vulnerability in Multiple BullGuard Products

BullGuard bdagent.sys is an antivirus program. An arbitrary write elevation of privilege vulnerability exists in several BullGuard products that allows local users to write data to arbitrary storage units and gain privileges via crafted 0x0022405c IOCTL calls...

Huawei Quidway Switch Elevation of Privilege Vulnerability

Huawei Quidway Switch is an Ethernet switch product from Huawei, China. A security vulnerability exists in Huawei Quidway Switch version V200R005C00SPC300. The vulnerability can be exploited by remote attackers to gain privileges with the help of specially crafted packets...

FreeBSD Local Elevation of Privilege Vulnerability (CNVD-2015-00830)

FreeBSD is a BSD-based operating system. FreeBSD suffers from a local elevation of privilege vulnerability, which allows local attackers to exploit this vulnerability to gain elevated privileges...

SAP ERP Dealer Portal Elevation of Privilege Vulnerability

SAP ERP is a set of integrated enterprise resource planning system based on customer/server structure and open system from SAP, Germany. The system supports custom reports, standardized processes and automated execution of business processes. A security vulnerability exists in Dealer Portal for S...

McAfee Data Loss Prevention Endpoint Elevation of Privilege Vulnerability

McAfee Network Data Loss Prevention monitors network traffic and protects against data loss. An elevation of privilege vulnerability exists in McAfee Data Loss Prevention Endpoint, which could allow a remote attacker to obtain elevation of privilege by sending carefully constructed commands to th...

samba: privilege elevation

Samba's Active Directory Domain Controller AD DC allows the administrator to delegate creation of user or computer accounts to specific users or groups. Samba's AD DC did not implement the additional required check on the UFSERVERTRUSTACCOUNT bit in the userAccountControl attributes. Most Samba...

Microsoft Windows Components Privilege Elevation Vulnerability (3025421)

This host is missing an important security update according to Microsoft Bulletin MS15-005. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Ansible Tower 'is_superuser' Parameter Remote Elevation of Privilege Vulnerability

Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. A remote elevation of privilege vulnerability exists in the Ansible Tower 'issuperuser' parameter, which can be exploited by an attacker to create a super administrator account and gain...

Apple Mac OS X XPC Type Obfuscated Local Elevation of Privilege Vulnerability

Apple Mac OS X is a BSD-based operating system of a commercial nature. A local elevation of privilege vulnerability exists in Apple Mac OS X XPC type obfuscation, which allows local attackers to exploit this vulnerability to elevate privileges...

Microsoft Windows Kernel-Mode Driver Privilege Elevation Vulnerability (3019215)

This host is missing an important security update according to Microsoft Bulletin MS15-008. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-0004

The User Profile Service aka ProfSvc in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction atta...

MS15-004: Description of the security update for Windows: January 13, 2015

None None...

Microsoft Censures Google Publishing Windows Vulnerability

Microsoft yesterday excoriated Google for disclosing information about a Windows security vulnerability just days ahead of the Patch Tuesday release slated to fix the bug. The rebuke came in the form of a Technet blogpost calling for better coordinated vulnerability disclosure. In reality, the ti...

Google Project Zero Discloses Windows Zero Day

Update: Google’s Project Zero has disclosed the details of an unpatched Windows vulnerability reported to Microsoft in September. The disclosure was made on Monday upon the expiration of 90-day waiting period imposed by Google researchers. Microsoft has yet to patch the Windows 8.1 vulnerability...