MiniPlasma-Detection

MiniPlasma Detection CVE-2020-17103 Sigma detection rule for MiniPlasma, a Windows local privilege escalation exploit abusing a race condition in cldflt.sys to hijack the windir environment variable for the SYSTEM account, redirecting the WER QueueReporting scheduled task to execute an attacker...

Exploit for Improper Privilege Management in Microsoft

MiniPlasma Detection CVE-2020-17103 Sigma detection rule fo...

CVE-2020-28369

In BeyondTrust Privilege Management for Windows aka PMfW through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp...

Buffer overflow

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

PT-2021-21078

Name of the Vulnerable Software and Affected Versions: Stormshield Endpoint Security Evolution versions 2.0.0 through 2.0.2 Description: The issue concerns local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%system32 with malicious ones, bypassing the intended defense...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Necurs Rootkit infect 83,427 machines in November

Rootkit named as "Necurs" infect 83,427 unique machines during the month of November 2012. It is a multi-purpose rootkits capable of posing a threat to both 32 and 64-bit Windows systems. Distributed via drive-by download on the websites that host the BlackHole exploit kit. Like other rootkits it...

CVE-2004-2713: Undefined Security Weakness

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2007-4785: Undefined Security Weakness

Sony Micro Vault Fingerprint Access Software, as distributed with Sony Micro Vault USM-F USB flash drives, installs a driver that hides a directory under %WINDIR%, which might allow remote attackers to bypass malware detection by placing files in this directory...

CVE-2006-6579: Undefined Security Weakness

Microsoft Windows XP has weak permissions FILEWRITEDATA and FILEREADDATA for Everyone for %WINDIR%\pchealth\ERRORREP\QHEADLES, which allows local users to write and read files in this folder, as demonstrated by an ASP shell that has write access by IWAMmachine and read access by IUSRMachine...