5235 matches found
Code injection
In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, because any program running on the local machine while CPU-Z is running can issue an ioctl 0x9C402430 call to the kernel-mode driver e.g., cpuz141x64.sys for version 1.41...
CVE-2017-15302
In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver e.g., cpuz143x64.sys for version 1.43 that can result in information disclosure or elevation of privileges, because of an arbitrary read of any physical address via ioctl 0x9C402604. Any application running on t...
CVE-2017-15302
CVE-2017-15302 affects CPUID CPU-Z (Windows) up to version 1.81. The root cause is improper access rights to the kernel-mode driver (cpuz143_x64.sys) that allows an arbitrary read of any physical address via ioctl 0x9C402604 and the driver to map any physical page, returning the map page address ...
CVE-2017-15303
CVE-2017-15303 affects CPUID CPU-Z prior to 1.43. The flaw allows an arbitrary memory write via an ioctl 0x9C402430 to the kernel-mode driver (cpuz141_x64.sys for v1.41), enabling local elevation of privileges on the same host. This is a kernel-space write condition originating from userland inte...
CVE-2017-8689
The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to...
CVE-2017-11783
Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability in the way it handles calls to Advanced Local Procedure Call ALPC, aka "Windows Elevation of Privilege Vulnerability"...
Windows Search Remote Code Execution Vulnerability
A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full...
Google Android HTC bootloader elevation of privilege vulnerability (CNVD-2017-32979)
Android is a free and open-source Linux-based operating system for mobile devices such as smartphones and tablets, led and developed by Google Inc. and the Open Handset Alliance. The Android HTC bootloader has a security vulnerability that allows an attacker to exploit the vulnerability to submit...
UBUNTU-CVE-2017-0807
An elevation of privilege vulnerability in the Android framework ui framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35056974...
CVE-2017-0829
An elevation of privilege vulnerability in the Motorola bootloader. Product: Android. Versions: Android kernel. Android ID: A-62345044...
CVE-2017-14773
Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid user in a debugger-pause state. The vulnerability can only be exploited by a local authenticated attacker...
CVE-2017-12230
A vulnerability in the web-based user interface web UI of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the...
Design/Logic Flaw
A vulnerability in the web-based user interface web UI of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the...
CVE-2017-12226
A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E Wireless Switches, and Cisco New Generation Wireless Controllers NGWC 3850 could allow an authenticated, remote attacker to elevate...
NVIDIA GPU Display Driver Local Elevation of Privilege Vulnerability (CNVD-2017-30724)
NVIDIA GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA. kernel mode layer handler is one of the kernel mode layer handler. A security vulnerability exists in the kernel mode layer handler in the NVIDIA GPU Display Driver. An attacker could exploit this vulnerabilit...
CVE-2017-8702
Windows Error Reporting WER in Microsoft Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows an attacker to gain greater access to sensitive information and system functionality, due to the way that WER handles and executes files, aka "Windows Elevation of Privilege Vulnerability"...
CVE-2017-8758
Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."...
Local elevation of privilege vulnerability in multiple IBM DB2 products (CNVD-2017-32877)
IBM DB2 and DB2 Connect Server for Linux, UNIX, and Windows are database products for Linux, UNIX, and Windows platforms from IBM Corporation, U.S.A. DB2 is a relational database management system for use in large application environments.DB2 Connect Server is a DB2 Connect Server is a mainframe...
IBM DB2 and DB2 Connect Server for Linux, UNIX and Windows Elevation of Privilege Vulnerability
IBM DB2 and DB2 Connect Server for Linux, UNIX, and Windows are database products for Linux, UNIX, and Windows platforms from IBM, U.S.A. DB2 is a relational database management system for use in large application environments.DB2 Connect Server is a DB2 Connect Server is a mainframe database...