293 matches found
CVE-2020-1048
CVE-2020-1048 当 Windows 打印后台处理程序服务不当地允许对文件系统进行任意写入时，存在一个权限提升漏洞。成功利用此漏洞的攻击者可以以提升的系统权限运行任意代码。随后攻击者可以安装程序；查看、更改或删除数据；或创建具有完全用户权限的新帐户。 要利用此漏洞，攻击者必须登录到受影响的系统并运行特制的脚本或应用程序。 Microsoft Windows 更新通过更正 Windows 打印后台处理程序组件写入文件系统的方式来修复此漏洞。 复现步骤 1.更改 Source.c 顶部的变量 gPortName 和 gInputFile。 2.使用 Visual Studio...
CVE-2023-36874_BOF
CVE-2023-36874 Windows 错误报告 LPE BOF 介绍 这是一个成熟且可运行的 CobaltStrike BOF 实现，基于 Filip Dragovic（@filipdragovic）的 CVE-2023-36874 Windows 错误报告 LPE 利用程序。他通过逆向相关的有漏洞的 DLL 并创建了该漏洞关键的非公开 COM 结构，在创建可用利用程序方面做了大量艰苦工作。 此 BOF 会将用户指定的 EXE 文件放置到目标机器的磁盘上，然后触发漏洞，导致该 EXE 以 SYSTEM 权限运行。 微软感谢谷歌威胁分析组披露此漏洞，然而我最初是通过...
cve-2021-1675
〖EXP〗Ladon打印机漏洞提权CVE-2021-1675复现 http://k8gege.org/p/CVE-2021-1675.html 基本情况 6月9日，微软发布6月安全更新补丁，修复了50个安全漏洞，其中包括一个Windows Print Spooler权限提升漏洞，漏洞CVE编号：CVE-2021-1675。未经身份验证的远程攻击者可利用该漏洞以SYSTEM权限在域控制器上执行任意代码，从而获得整个域的控制权。建议受影响用户及时更新漏洞补丁进行防护，做好资产自查以及预防工作，以免遭受黑客攻击。 漏洞描述 Print...
CVE-2019-8805
CVE-2019-8805 CVE-2019-8805 Apple EndpointSecurity 框架权限提升漏洞利用 权限验证中存在一个验证问题。该问题通过改进进程权限验证得到解决。此问题已在 macOS Catalina 10.15.1 中修复。应用程序可能能够以系统权限执行任意代码。 编译与执行 编译 gcc -framework Foundation appleEPSPrivEsc.m -o appleEPSPrivEsc 执行 ./appleEPSPrivEsc...
CVE-2020-1048
CVE-2020-1048 CVE-2020-1048PrintDemon 的 POC 漏洞利用代码 受影响系统 下面链接中提到的所有 Windows 版本均受影响: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1048 复现步骤 1. 修改 Source.c 顶部的变量 gPortName 和 gInputFile。 2. 使用 Visual Studio 编译并运行。 3. 重启打印机服务spoolsv或重启系统。 备注...
CVE-2023-27350
CVE-2023-27350 此漏洞允许远程攻击者绕过 PaperCut NG 22.0.5 Build 63914 受影响安装上的认证。利用此漏洞无需认证。该特定缺陷存在于 SetupCompleted 类中。问题源于不正确的访问控制。攻击者可利用此漏洞绕过认证并在 SYSTEM 上下文中执行任意代码。曾是 ZDI-CAN-18987。...
CVE-2026-91812
A vulnerability in the Foxit PDF Editor/Reader update mechanism (specifically FoxitUpdater ) allows man-in-the-middle attackers to bypass certificate validation and package integrity checks . This flaw could potentially enable arbitrary code execution with system privileges . No specific remediat...
CVE-2026-92253
WatchDog Anti-Virus 1.8.640 on Windows is affected by an improper link resolution vulnerability in its quarantine restoration process . A local, low-privileged attacker can create a directory junction at the original path of a quarantined file and, by persuading an administrator to restore that f...
CVE-2026-12518
A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...
CVE-2026-69665
SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege...
CVE-2026-18263
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...
CVE-2026-13121
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...
CVE-2026-18262 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS RDP...
CVE-2026-13268
G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...
CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...
CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...
CVE-2026-15380
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...
CVE-2026-15380 Local privilege escalation in Symantec ITMS
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...
