2977 matches found
Did the “Man With No Name” Feel Insecure?
Posted by James Forshaw, Taker of Names Sometimes when I'm doing security research I'll come across a bug which surprises me. I discovered just such a bug in the Windows version of Chrome which exposed a little-known security detail in the OS. The bug, CVE-2014-3196 was fixed in M38, so it seemed...
VulnCheck KEV: CVE-2014-4113
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation...
PT-2014-1733 · Microsoft · Windows 8 +8
Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 Description: The...
Windows Win32k Pointer Dereferencement PoC (MS10-098)
No description provided by source. / MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user may be able to cau...
Windows NT - Windows 8 EPATHOBJ Local Ring 0 Exploit
No description provided by source. ifndef WIN32NOSTATUS define WIN32NOSTATUS endif include stdio.h include stdarg.h include stddef.h include windows.h include assert.h ifdef WIN32NOSTATUS undef WIN32NOSTATUS endif include ntstatus.h pragma commentlib, gdi32 pragma commentlib, kernel32 pragma...
MS10-073: Win32k Keyboard Layout Vulnerability
No description provided by source...
Microsoft Windows win32k!xxxRealDrawMenuItem() Missing HBITMAP Bounds Checks
No description provided by source. Microsoft Windows win32k!xxxRealDrawMenuItem missing HBITMAP bounds checks ---------------------------------------------------------------------------- Microsoft produce two builds of each of thier supported operating system, a checked build and a free build. Th...
Microsoft Windows win32k!GreStretchBltInternal() Does Not Handle src == dest
No description provided by source. Microsoft Windows win32k!GreStretchBltInternal does not handle src == dest ---------------------------------------------------------------------------- A bitblt bit block transfer is used to copy one rectangular region of screen to another, often performing a...
MS15-061 Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
No description provided by source. include include / Exploiting MS15-061 with reverse engineering Win32k.sys by steps : 1: hook PEB callback Function 2: trigger vulnerability make proper Window to lead vulnerable function 3: replace fake object with NtUserDefSetText in Desktop heap inside PEB...
Windows TrackPopupMenuEx Win32k NULL Page
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...
Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
A kernel pool overflow in Win32k which allows local privilege escalation. The kernel shellcode nulls the ACL for the winlogon.exe process a SYSTEM process. This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. Used in pwn2own 2013 by MWR to break...
Microsoft Windows - NTUserMessageCall Win32k Kernel Pool Overflow 'schlamperei.x86.dll' (MS13-053) (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows NTUserMessageCall Win32k Kernel Pool Overflow...
Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows NTUserMessageCall Win32k Kernel Pool Overflow...
CVE-2014-0323
CVE-2014-0323 affects Microsoft Windows kernel-mode driver win32k.sys, enabling local attackers to disclose kernel memory contents or trigger a system hang via a crafted application. Affected products include Windows XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, Windo...
Microsoft Windows - TrackPopupMenuEx Win32k NULL Page (MS13-081) (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows TrackPopupMenuEx Win32k NULL Page', 'Description' = %q...
CVE-2014-0262
The CVE-2014-0262 issue affects Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1, specifically the Win32k.sys kernel-mode driver. The vulnerability arises during the processing of window handles, where thread-owned objects are not properly considered, enabling local privilege escalation via...
Microsoft Windows security vulnerabilities
Privilege escalations via NDProxy and win32k...
CVE-2014-0262: Undefined Security Weakness
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Server 2008 R2 SP1 does not properly consider thread-owned objects during the processing of window handles, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."...
Sandbox Escape: Win32k Window Handle Vulnerability (EoP)
This bug was disclosed directly to Microsoft. http://technet.microsoft.com/en-us/security/bulletin/ms14-003...
Design/Logic Flaw
Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1 and Windows 7 SP1 on 64-bit platforms allows local users to gain privileges via a crafted application, aka "Win32k Use After Free Vulnerability."...