TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes

This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode...

KLA12213 RCE vulnerability in Microsoft Windows

A remote code execution vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-34527 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware...

Microsoft Windows Print Spooler allows for RCE via AddPrinterDriverEx()

Overview The Microsoft Windows Print Spooler service fails to restrict access to functionality that allows users to add printers and related drivers, which can allow a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. Description The...

Microsoft Windows 10 suffers from a denial of service vulnerability (CNVD-2021-48958)

Microsoft Windows 10 is a set of operating systems for use on personal computers. A denial of service vulnerability exists in Microsoft Windows 10. An attacker can exploit the vulnerability to cause the operating system to blue screen...

Microsoft Windows 10 suffers from a denial of service vulnerability (CNVD-2021-46822)

Microsoft Windows 10 is a set of operating systems for use on personal computers. Microsoft Windows 10 has a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Veeam Agent for Microsoft Windows can't be auto-updated to the latest version on Windows 7, 2008 R2, 2012

Challenge Veeam Agent fails to run auto-update and download the latest version on the following operating systems: Microsoft Windows 7 SP1 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows Server 2012 Cause Veeam Agent utilizes BITS to download the latest versions from...

Low: samba

Issue Overview: No CVE associated with this advisory Affected Packages: samba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update samba or yum update...

Lexmark Printers Open to Arbitrary Code-Execution Zero Day

Lexmark printers – those ubiquitous, inky office workhorses that fill homes and offices, and are found all the way on up to the federal government – have an unpatched vulnerability that could lead to serious, easy-to-execute attacks that require neither privileges nor user interaction and which c...

PT-2021-4650 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to an integer overflow in the storport.sys driver component, which provides functionality for Storage Spaces in Microsoft Windows operating systems. This can ...

PT-2021-6942

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Storage Spaces Controller driver, which is caused by insecure privilege management. This vulnerability can be...

Microsoft Windows Multiple Vulnerabilities (KB5003637)

This host is missing a critical security update according to Microsoft KB5003637 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5003687)

This host is missing a critical security update according to Microsoft KB5003687 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5003638)

This host is missing a critical security update according to Microsoft KB5003638 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5003646)

This host is missing a critical security update according to Microsoft KB5003646 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows CLFS Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the clfs.sys drive...

Microsoft Windows Multiple Vulnerabilities (KB5003635)

This host is missing a critical security update according to Microsoft KB5003635 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5003667)

This host is missing a critical security update according to Microsoft KB5003667 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB5003671)

This host is missing a critical security update according to Microsoft KB5003671 SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Defender Remote Code Execution Vulnerability (CNVD-2021-49070)

Microsoft Windows is a windowed operating system developed by Microsoft Corporation in the United States. A remote code execution vulnerability exists in Microsoft Defender. An attacker could exploit this vulnerability to execute code on the target host...

Backdoor.Win32.XRat.d Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/dc77b126b205b0f671e505766c607ef1.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.XRat.d Vulnerability: Unauthenticated Remote Command Execution Description: XRat...