Privilege escalation

An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-67494)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68737)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows...

Input Director 1.4.3 Unquoted Service Path Vulnerability

Exploit Title: Input Director 1.4.3 - 'Input Director' Unquoted Service Path Discovery Date: 2020-09-08 Response from Input Director Support: 09/09/2020 Exploit Author: TOUHAMI Kasbaoui Vendor Homepage: https://www.inputdirector.com/ Version: 1.4.3 Tested on: Windows Server 2012, Windows 10 Find...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-67495)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA Microsoft Windows is an operating system for personal devices Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server. Th...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-67496)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows...

CVE-2020-7323

Authentication Protection Bypass vulnerability in McAfee Endpoint Security ENS for Windows prior to 10.7.0 September 2020 Update allows physical local users to bypass the Windows lock screen via triggering certain detection events while the computer screen is locked and the McTray.exe is running...

Input Director 1.4.3 Unquoted Service Path

Exploit Title: Input Director 1.4.3 - 'Input Director' Unquoted Service Path Discovery Date: 2020-09-08 Response from Input Director Support: 09/09/2020 Exploit Author: TOUHAMI Kasbaoui Vendor Homepage: https://www.inputdirector.com/ Version: 1.4.3 Tested on: Windows Server 2012, Windows 10 Find...

The vulnerability of the DirectX component in Windows operating systems allows attackers to gain rights to install programs, view, modify, or delete data, as well as create new accounts with full user privileges.

The vulnerability of the DirectX component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain privileges to install programs, view, modify, or delete data, and create new user accounts with full user rights using a...

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the ssdpsrv.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a specially...

PT-2020-4024 · Microsoft · Onedrive For Windows

Name of the Vulnerable Software and Affected Versions: OneDrive for Windows affected versions not specified Description: The issue is related to the improper handling of symbolic links by the OneDrive for Windows Desktop application. This could allow an attacker to overwrite a targeted file with ...

ShareMouse 5.0.43 - (ShareMouse Service) Unquoted Service Path Vulnerability

Exploit Title: ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path Discovery by: Alan Lacerda alacerda Vendor Homepage: https://www.sharemouse.com/ Software Link: https://www.sharemouse.com/ShareMouseSetup.exe Version: 5.0.43 Tested on OS: Microsoft Windows 10 Pro EN OS Version:...

PT-2020-3899 · Microsoft · Windows Shell +1

Name of the Vulnerable Software and Affected Versions: Windows Shell affected versions not specified Description: The issue is related to the improper handling of objects in memory by the Shell infrastructure component, allowing an attacker to potentially run processes in an elevated context. To...

PT-2020-4082 · Microsoft · Windows Language Pack Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Language Pack Installer affected versions not specified Description: The issue is related to the improper handling of file operations by the Windows Language Pack Installer, allowing an attacker to run processes in an elevated context...

CVE-2020-7323

Authentication Protection Bypass vulnerability in McAfee Endpoint Security ENS for Windows prior to 10.7.0 September 2020 Update allows physical local users to bypass the Windows lock screen via triggering certain detection events while the computer screen is locked and the McTray.exe is running...

PT-2020-4079 · Microsoft · Windows Runtime +1

Name of the Vulnerable Software and Affected Versions: Windows Runtime affected versions not specified Description: The issue is related to errors in access control within the Windows Runtime component of the Windows operating system. It allows an attacker to execute arbitrary code with elevated...

PT-2020-4019 · Microsoft · Onedrive For Windows Desktop

Name of the Vulnerable Software and Affected Versions: OneDrive for Windows Desktop affected versions not specified Description: The issue arises from the improper handling of symbolic links by the OneDrive for Windows Desktop application, leading to a potential elevation of privilege. An attacke...

Vulnerability fixed in Bitdefender Endpoint Security

Bitdefender has fixed an update in Bitdefender Endpoint Security Tools and the Endpoint Security SDK. The vulnerability could potentially be exploited by a malicious party to obtain elevated user privileges and manipulate data. Bitdefender categorizes this vulnerability according to the CVSSv3...

Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path

Exploit Title: Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path Discovery Date: 2020-09-03 Discovery by: chipo Vendor Homepage: https://nordvpn.com Software Link : https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe Tested Version: 6.31.13.0 Tested on OS:...

Nord VPN 6.31.13.0 - (nordvpn-service) Unquoted Service Path Vulnerability

Exploit Title: Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path Discovery by: chipo Vendor Homepage: https://nordvpn.com Software Link : https://downloads.nordcdn.com/apps/windows/10/NordVPN/latest/NordVPNSetup.exe Tested Version: 6.31.13.0 Tested on OS: Windows 10 Pro x64 es...