CVE-2025-48799

Descripción Esto es un PoC para CVE-2025-48799, una vulnerabilidad de elevación de privilegios en el servicio de Windows Update. Esta vulnerabilidad afecta a clientes Windows win11/win10 con al menos 2 discos duros. Cuando la máquina tiene múltiples discos duros, es posible cambiar la ubicación...

CVE-2020-1313

CVE-2020-1313 摘要 Windows 更新编排器服务（Windows Update Orchestrator Service）是一个 DCOM 服务，其他组件使用它来安装已下载的 Windows 更新。由于对调用者的授权不当，USO 存在权限提升漏洞（任意用户提升至本地系统）。该漏洞影响 Windows 10 和 Windows Server Core 产品。微软已在 2020 年 6 月补丁星期二中修复。 漏洞详情 UniversalOrchestrator 服务（9C695035-48D2-4229-8B73-4C70E756E519）在 usosvc.dll 中实现，以...

nuc-winring0-fix

Intel NUC WinRing0 易受攻击驱动 - 永久移除指南 Windows Defender 将 OpenHardwareMonitorLib.sys（WinRing0 驱动）标记为 VulnerableDriver:WinNT/Winring0 ，原因是 CVE-2020-14979。该驱动与 Intel 的 NUC Software Studio 服务捆绑，并通过 Windows Update 重新安装。 本仓库提供永久解决方案。 问题所在 1. Intel 的 performancedriverextension.inf 安装 NucSoftwareStudioServi...

CVE-2023-23397-Patch

CVE-2023-23397 Windows Update 补丁 用于 Windows 10 和 11 的 CVE-2023-23397 PowerShell 补丁脚本 此脚本版本允许您检查设备是否已安装针对最新微软漏洞的最远推送补丁。如果使用 PowerShell 命令 Get-Hotfix 未找到安全更新，它将下载最新的 Windows 更新并静默安装，无需重启。但仍建议您根据需要重新启动计算机。 对于大多数人来说，安装 Windows 更新应能解决此问题。由于 VPN 问题或用户未连接而无法访问域服务器的设备可从此脚本中受益。 上帝保佑。...

CVE-2025-48799

Descripción Este es un PoC para CVE-2025-48799, una vulnerabilidad de elevación de privilegios en el servicio de Windows Update. Esta vulnerabilidad afecta a clientes de Windows win11/win10 con al menos 2 discos duros. Cuando la máquina tiene múltiples discos duros, es posible cambiar la ubicació...

PPLmedic

PPLmedic Esta herramienta implementa una cadena de exploits en modo usuario para inyectar código arbitrario en un PPL con el tipo de firmante Windows y elevarlo al tipo de firmante WinTcb. Estas técnicas fueron discutidas originalmente por James Forshaw también conocido como @tiraniddo en su...

dazzleUP

dazzleUP 一款用于检测 Windows 操作系统中由配置错误和缺失更新引发的权限提升漏洞的工具。dazzleUP 可检测以下漏洞。 漏洞利用检测 dazzleUP 的第一个特点是，它在查找缺失补丁时使用 Windows Update Agent API，而非 WMI（像其他工具那样）。dazzleUP 检查以下漏洞。 DCOM/NTLM 反射（Rotten/Juicy Potato）漏洞 CVE-2019-0836 CVE-2019-0841 CVE-2019-1064 CVE-2019-1130 CVE-2019-1253 CVE-2019-1385 CVE-2019-1388...

September Microsoft Patch Tuesday

September Microsoft Patch Tuesday. A total of 973 vulnerabilities were addressed - more than twice as many as in August. Seven products had 20 or more vulnerabilities fixed: Windows Biometric Service 64, Microsoft SQL Server 54, Windows DHCP Server 36, Microsoft Office Word 35, Windows NTFS 29,...

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in the wild. These include 723 flaws in Windows, 111 in Office and Office 2016, 62 in SQL, and 22 i...

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...

CVE-2026-81963

Improper link resolution before file access 'link following' in Windows Update Stack allows an authorized attacker to elevate privileges locally...

EUVD-2026-73889

Improper link resolution before file access 'link following' in Windows Update Stack allows an authorized attacker to elevate privileges locally...

CVE-2026-81963

Windows Update Stack is affected by an improper link resolution before file access ('link following') flaw that allows an authorized attacker with low privileges to elevate privileges locally , rated CVSS 7.8 HIGH with high impact to confidentiality, integrity, and availability. The vulnerability...

Windows Update Stack Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Update Stack allows an authorized attacker to elevate privileges locally...

Microsoft Windows Link Following Vulnerability

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM...

PT-2026-88102

🚨HIGH - Windows Update Stack EoP via Link Following CVE-2026-81963 Windows Update Stack performs improper link resolution before file access, allowing an authenticated local attacker to abuse junctions/symlinks to redirect privileged file operations to unintended paths. This link-following flaw c...

VulnCheck KEV: CVE-2026-81963

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM...

August 11, 2026—KB5121000 (OS Build 28000.2704)

None None...

Important: Red Hat Security Advisory: OpenJDK 8u502 Windows Security Update

An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

KLA91174 ACE vulnerability in Microsoft Apps

Arbitrary code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-50517 Exploitation CVE list CVE-2026-50517 critical KB list Solution Install necessary updates from the KB section, that are...