Improper access control

An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by connecting to the filter communication port and then using IOCTL 0x8000204C to \.\ZemanaAntiMalware to elevate...

CVE-2018-6593: Incorrect Permission Assignment for Critical Resource

An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by connecting to the filter communication port and then using IOCTL 0x8000204C to \.\ZemanaAntiMalware to elevate...

SUPERAntiSpyware Professional Trial SASKUTIL.SYS Driver Elevation of Privilege Vulnerability

SUPERAntiSpyware Professional Trial is a suite of antivirus tools mainly used for scanning for spyware from Support.com, USA.SASKUTIL.SYS driver is one of the drivers that communicates with the hardware. A security vulnerability exists in the SASKUTIL.SYS driver in SUPERAntiSpyware Professional...

PT-2018-17451

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue concerns a Local Privilege Escalation in Kaspersky Secure Mail Gateway, allowing for potential elevation of privileges. Recommendations For Kaspersky Secure Mail Gateway version...

CVE-2017-1000403

Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts...

CVE-2017-1000403

Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts...

Siemens TeleControl Server Basic Elevation of Privilege Vulnerability

Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens, Germany. A security vulnerability exists in Siemens TeleControl Server Basic versions prior to 3.1. An attacker could use this vulnerability to elevate privileges and perform administrative operations...

PT-2018-5185

Name of the Vulnerable Software and Affected Versions Jenkins Speaks! Plugin, all current versions Description The issue allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts. Recommendations For all...

CVE-2017-1000403: Incorrect Permission Assignment for Critical Resource

Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts...

Code injection

Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access...

CVE-2017-5696

CVE-2017-5696 corresponds to an untrusted search path in Intel Graphics Driver (Windows) across 15.40.x.x, 15.45.x.x and 21.20.x.x that can let an unprivileged local user elevate privileges. The connected sources confirm this as a privilege-escalation issue via local access, caused by an untruste...

Oracle VM VirtualBox Elevation of Privilege Vulnerability (CNVD-2018-02060)

Oracle Virtualization is the American Oracle Oracle company's set of hardware and software virtualization management solutions. Oracle VM VirtualBox is one of the virtual machine components. A security vulnerability exists in the Oracle VM VirtualBox component of Oracle Virtualization, versions...

Cisco ESA and Content SMA Elevation of Privilege Vulnerabilities

Cisco Email Security Appliances ESAs are email security gateway products designed to detect and block a variety of email-borne threats, such as malware, spam, and phishing attacks.The Cisco Content Security Management Appliance SMA centralizes multiple Cisco email and network security appliances'...

PT-2018-2068

Name of the Vulnerable Software and Affected Versions: D-Link DIR-620 affected versions not specified Description: The issue is related to the use of predefined registration data in the firmware of the affected device. It allows a remote attacker to elevate privileges and execute arbitrary code...

CVE-2017-13176

In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a remote elevation of privilege that could enable bypassing user interaction requirements with no additional execution privileges needed. User interaction is needed for...

Double free

In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. This could lead to an local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is...

CVE-2017-13215

A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Android ID: A-64386293. References: Upstream kernel...

CVE-2017-13226

An elevation of privilege vulnerability in the MediaTek mtk. Product: Android. Versions: Android kernel. Android ID: A-32591194. References: M-ALPS03149184...

CVE-2017-13184

CVE-2017-13184 affects Android 8.0–8.1 SurfaceFlinger. In enableVSyncInjections, a use-after-free on mVSyncInjector can enable local elevation of privilege with code execution in a privileged process; no user interaction required. Exploitation details are not provided in the connected documents. ...

CVE-2017-13180

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution a...