19 matches found
CVE-2026-50343-InstallService-EoP
CVE-2026-50343: InstallService StaticPluginMap EoP Standard User to SYSTEM I independently discovered and reported the vulnerability now tracked as CVE-2026-50343. MSRC confirmed my submission as a duplicate of an earlier report from another researcher. A standard interactive user can write...
CVE-2026-69328
StorSvc loads SprintCSP.dll by relative name as SYSTEM. Plant it in a user-writable HKLM PATH directory, get SYSTEM. Requires a user-writable directory in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path. None on a clean image. Tooling installers add them...
Windows Office CVE-2026-21509 kill-bit manage
Post-exploitation module for CVE-2026-21509 Office OLE/COM kill-bit bypass around Shell.Explorer.1 / CLSID EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B. Checks registry Compatibility Flags=0x400, applies/removes the temporary kill-bit mitigation, checks related KBs, or writes a dummy RTF probe. Requires ...
Windows Winlogon registry symlink deletion (CVE-2026-42989)
Plants a volatile registry symlink under the interactive session SAT key. On logout and reboot, Winlogon SYSTEM deletes the SAT subtree and follows the link into an arbitrary HKLM target path. Requires an interactive logon session. !/usr/bin/env python3 -- coding: utf-8 -- from future import...
CVE-2025-35054: Insecure Storage of Sensitive Information
Newforma Info Exchange NIX stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\ \Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If...
CVE-2025-52094: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy component...
Fetch the HKLM\SAM registry data
Fetch the HKLM\SAM registry data C Tenable Network Security, Inc. include"compat.inc"; if description scriptid160511; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/28"; scriptnameenglish:"Fetch the HKLM\SAM registry data"; scriptsummaryenglish:"Fetch the...
CVE-2019-14743
In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...
CVE-2019-14743: Incorrect Permission Assignment for Critical Resource
In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...
PT-2019-13811
Name of the Vulnerable Software and Affected Versions Valve Steam Client for Windows versions prior to 2019-08-07 Description The issue allows local users to gain NT AUTHORITYSYSTEM access due to explicit "Full control" for the Users group in the HKLMSOFTWAREWow6432NodeValveSteam registry key...
PT-2018-2788
Name of the Vulnerable Software and Affected Versions Galaktika ERP affected versions not specified Description The issue is related to the storage of administrator user credentials in plain text, which can be used to configure the software. An attacker with local access can exploit this to revea...
Latest Windows UAC Bypass Permits Code Execution
Less than a month after disclosing a Windows User Account Control bypass, researcher Matt Nelson today published another attack that circumvents the security feature and leaves no traces on the hard disk. This time, the bypass relies on Event Viewer eventvwr.exe, a native Windows feature used to...
Matrix42 Remote Control Host 3.20.0031 Privilege Escalation
Exploit Title: Matrix42 Remote Control Host - Unquoted Path Privilege Escalation Date: 06-05-2016 Exploit Author: Roland C. Redl Vendor Homepage: https://www.matrix42.com/ Software Link: n/a Version: 3.20.0031 Tested on: Windows 7 Enterprise SP1 x64 CVE : n/a 1. Description: sc qc...
Windows Gather VNC Password Extraction
This module extract DES encrypted passwords in known VNC locations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather VNC Password Extraction', 'Description' = %q This module extrac...
CVE-2008-2747: Exposure of Sensitive Information to an Unauthorized Actor
No-IP Dynamic Update Client DUC 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the 1 TrayPassword, 2 Username, 3 Password, and 4 Hosts registry values...
Use of system agreement when the backdoor-vulnerability warning-the black bar safety net
This morning inadvertently open the xFocus of a cow's BLOG...The New Year's firsthaha. Found a very interesting thing. Is the use of the system in the registered agreement to execute the command. 具体 连接 :http://coolice.blogdriver.com/coolice/414334.html Then I on their own machine experiment:it...
CVE-2006-4266: Undefined Security Weakness
Symantec Norton Personal Firewall 2006 9.1.0.33, and possibly earlier, does not properly protect Norton registry keys, which allows local users to provide Trojan horse libraries to Norton by using RegSaveKey and RegRestoreKey to modify HKLM\SOFTWARE\Symantec\CCPD\SuiteOwners, as demonstrated usin...
