Microsoft’s privilege escalation vulnerability that refuses to go away

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here After seven months, a vulnerability that was addressed in August 2021 patch Tuesday remained unpatched. This locally exploited vulnerability is tracked as CVE-2021-34484 and affects the Windows User Profile Service. While...

Microsoft Tablet Windows User Interface 权限许可和访问控制问题漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A vulnerability exists in Microsoft Tablet Windows User Interface with privilege permission and access control issues. The following products and editions are affected: Windows Server...

CVE-2019-16864

CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM...

Remote code execution

CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM...

CVE-2019-16864

CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM...

Denial of service

Windows User Account Profile Picture Denial of Service Vulnerability...

Siemens IEC 61850 System Configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC Improper Access Control (CVE-2018-4858)

A vulnerability has been identified in IEC 61850 system configurator All versions V5.80, DIGSI 5 affected as IEC 61850 system configurator is incorporated All versions V7.80, DIGSI 4 All versions V4.93, SICAM PAS/PQS All versions V8.11, SICAM PQ Analyzer All versions V3.11, SICAM SCC All versions...

CVE-2022-21919

Windows User Profile Service Elevation of Privilege Vulnerability...

CVE-2022-21834

Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability...

Privilege escalation

Windows User Profile Service Elevation of Privilege Vulnerability...

CVE-2022-21834 Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability

...

Windows User Profile Service Elevation of Privilege Vulnerability

...

PT-2022-1526 · Microsoft · Windows User-Mode Driver Framework Reflector Driver +1

Name of the Vulnerable Software and Affected Versions: Windows User-mode Driver Framework Reflector Driver affected versions not specified Description: The issue is related to errors in privilege management, allowing an attacker to potentially elevate their privileges. This could enable an attack...

PT-2022-1515 · Microsoft · Windows Ui Immersive Server Api +1

Name of the Vulnerable Software and Affected Versions: Windows UI Immersive Server API affected versions not specified Description: The issue is related to insecure privilege management in the Windows UI Immersive Server API component of the Windows operating system. Exploitation of this issue ma...

Microsoft Windows User-mode Driver Framework权限许可和访问控制问题漏洞

Microsoft Windows User-mode Driver Framework is a user-mode driver framework from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows User-mode Driver Framework due to permission and access control issues. The following products and editions are affected:Windows 10 Version...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

CVE-2021-40827

Clementine Music Player through 1.3.1 when a GLib 2.0.0 DLL is used is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is...

CVE-2021-40826

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...

Code injection

Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at clementine+0x3aa207. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine...