Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion

Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure...

Heap overflow

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are...

Meltdown vulnerability in CPU processor kernel (CNVD-2018-00304)

CPU hardware is a set of firmware that runs in the CPU Central Processing Unit to manage and control the CPU. A Meltdown vulnerability exists in the CPU processor kernel that "melts" the security boundaries implemented by the hardware, allowing low-privileged user-level applications to "cross the...

Microsoft Windows PPL Process Injection Privilege Escalation Exploit

Exploit for windows platform in category dos / poc Windows: PPL Process Injection EoP Platform: Windows 10 1703 x64 Class: Elevation of Privilege Summary: It’s possible to inject code into a PPL protected process by hijacking COM objects leading to accessing PPL processes such as Lsa and...

VirtualBox 5.1.22 - Windows Process DLL Signature Bypass Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1257 VirtualBox: Windows Process DLL Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process...

VirtualBox 5.1.22 - Windows Process DLL Signature Bypass Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1257 VirtualBox: Windows Process DLL Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process hardening implemented by the VirtualBox driver can be...

VirtualBox 5.1.22 - Windows Process DLL UNC Path Signature Bypass Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1296 VirtualBox: Windows Process DLL UNC Path Signature Bypass EoP Platform: VirtualBox v5.1.22 r115126 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process hardening implemented by the VirtualBox driver can ...

GitLab: Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution

Test Conditions ============= This issue was tested in GitLab Community Edition using a combination of code review against git commit 6c65b63ca5, April 20 2017 and testing likely issues against a local deployment of Bitnami GitLab Community Edition 9.0.5-0, running on Ubuntu 14.04.5. These are...

Fileless UAC Bypass Uses Windows Backup and Restore Utility

One nugget buried in a recent Vault 7 dump was a bypass of User Account Controls in Windows 7 that allows applications to execute code without triggering the familiar prompt to the user that something may be afoot. Microsoft has not, in the past, considered UAC bypasses a security boundary that...

drchrono: Angular injection in the profile name of onpatient

Hi All, You have an angular injection vulnerability in the profile name fields on the onpatient site. If you add a value 55 in the first name or last name field, the expression will be evaluated and when the page is rendered, the first and last name will be 25. Here I'm entering the values F96238...

Apple Mac OSX / iOS - NECP System Control Socket Packet Parsing Kernel Code Execution Integer Overfl

Exploit for multiple platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=543 NKE control sockets are documented here: https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/NKEConceptual/control/control.html By default ther...

Google from the Android system vulnerabilities Samsung security risks a lot-vulnerability warning-the black bar safety net

! According to the latest reports, nearly a week, the Google team have been trying to challenge“the Android security boundaries”, they want to know their ability by certain means, in the Not and user the exchange of the premise, remote access to the user's address book, photos and information; fi...

Beginner's error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of other account

Hi @ll, the import function of Windows Mail executes a rogue program C:Program.exe with the credentials of another account, resulting in a privilege escalation! 1. Fetch http://home.arcor.de/skanthak/download/SENTINEL.EXE and save it as C:Program.exe 2. Start Windows Mail part of Windows Vista an...

Windows Mail Rogue Program.exe Execution

Hi @ll, the import function of Windows Mail executes a rogue program C:\Program.exe with the credentials of another account, resulting in a privilege escalation! 1. Fetch and save it as C:\Program.exe 2. Start Windows Mail part of Windows Vista and Windows Server 2008 3. On the File menu, click...

Cross site scripting

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes...

CVE-2010-1886

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by leveraging access to a process with NetworkService credentials, as demonstrated by TAPI Server, SQL Server, and IIS processes...

CVE-2010-1886

CVE-2010-1886 represents a local privilege-escalation issue in Windows where an attacker with access to a process running under the NetworkService account can gain LocalSystem privileges via the Windows Service Isolation mechanism. Documented vectors involve the TAPI Server and other services suc...

CVE-2007-3463

Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs run as command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program. NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are...

Microsoft Incoming SMB Packet Validation Remote Buffer Overflow Vulnerability

Description Microsoft SMB is susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer. Remote attackers may exploit this vulnerability to execut...

CVE-2005-1686

CVE-2005-1686 affects gedit/gedit-based GNOME environments. The vulnerability is a format string flaw in the handling of filenames (format specifiers in filenames) that could lead to a crash and, per multiple advisories, may allow arbitrary code execution. Public discussions in various advisories...