CVE-2022-26923

CVE-2022-26923 affects Microsoft Active Directory Domain Services with AD CS involvement. The vulnerability stems from certificates issued by AD CS where an attacker who manages computer accounts can modify the dNSHostName attribute to impersonate a Domain Controller in a certificate, enabling pr...

CVE-2019-1130

CVE-2019-1130 is a Windows privilege-escalation vulnerability in the AppX Deployment Service (AppXSVC) caused by improper handling of hard links. The CVE notes an elevation of privilege from a local user, with a CVSSv3.1 base score of 7.8 (LOCAL attack, LOW complexity, Privileges Required: LOW; U...

CVE-2021-33771

CVE-2021-33771 is a Windows Kernel Elevation of Privilege vulnerability affecting Windows kernels; multiple sources classify it as a local, low-complexity EoP with high impact. Several connected documents reference active exploitation in the wild or near-wild activity, including reports of target...

CVE-2020-1464

CVE-2020-1464 is a Windows spoofing vulnerability where improper validation of code-signing signatures allows bypassing security features and loading improperly signed files. It affects Windows and was actively exploited in the wild, per reports linked to the August 2020 Patch Tuesday. The core i...

CVE-2023-38545

CVE-2023-38545 is a heap-based buffer overflow in curl/libcurl during SOCKS5 proxy hostname handling. When a long host name (over 255 bytes) is passed for proxy resolution, curl may copy the full hostname into the target buffer due to a race in a slow handshake, enabling arbitrary code execution....

CVE-2021-28310

CVE-2021-28310 is a Win32k Elevation of Privilege vulnerability in Microsoft Windows. Project Zero’s 2021 review notes Win32k 0-day activity among in-the-wild exploits, with CVE-2021-28310 listed as one of the Windows 0-days targeted in 2021 (alongside other Win32k issues). The CVE entry is suppo...

CVE-2021-36955

CVE-2021-36955 is a Windows privilege-escalation flaw in the Common Log File System (CLFS) driver. The vulnerability stems from the CLFS driver (clfs.sys) and enables local privilege escalation to SYSTEM when exploited. Connected guidance and threat intel cite this CVE alongside Windows CLFS-rela...

CVE-2019-1069

CVE-2019-1069 is a Windows Task Scheduler Privilege Escalation vulnerability in which the Task Scheduler Service inadequately validates certain file operations. The issue enables local privilege escalation when an attacker with unprivileged code execution on a victim system exploits the flaw. Mic...

CVE-2020-0610

CVE-2020-0610 is a Windows RD Gateway vulnerability (BlueGate) that enables unauthenticated remote code execution over UDP/3391. The RD Gateway role with UDP transport enabled is affected; exploitation targets the gateway service via specially crafted UDP traffic, enabling full compromise (per th...

CVE-2019-1253

CVE-2019-1253 describes a local privilege-escalation in Microsoft Windows AppX Deployment Server caused by improper handling of junctions. The vulnerability allows an attacker who already has code execution on the target system to elevate privileges (local attack, low integrity/login requirements...

CVE-2019-1215

CVE-2019-1215 describes a local privilege-escalation in Windows via ws2ifsl.sys (Winsock) where improper handling of memory-resident objects enables code execution with elevated privileges. Affected component is Winsock’s ws2ifsl.sys; root cause is memory handling of objects within the Winsock su...

CVE-2022-26904

CVE-2022-26904 is a Windows User Profile Service Elevation of Privilege vulnerability. The issue is a race-condition–driven LPE in the User Profile Service, with attacker-controlled code execution at SYSTEM granted by bypasses and PoCs described in public sources. A Metasploit module exists for t...

CVE-2019-1315

CVE-2019-1315 describes a local privilege-escalation in Windows Error Reporting Manager, triggered when hard links are mishandled. Affected: Windows OS components involving Error Reporting; root cause is improper handling leading to unauthorized file manipulation and elevation. CVSSv3.1 base scor...

CVE-2019-0703

CVE-2019-0703 is described in the initial doc as an information-disclosure vulnerability in the Windows SMB Server’s handling of certain requests, distinct from CVE-2019-0704 and CVE-2019-0821. Connected sources add concrete context: FireEye/Mandiant notes this CVE was used in targeted attacks du...

CVE-2019-1214

CVE-2019-1214 is a Windows privilege-escalation vulnerability in the Windows Common Log File System (CLFS) Driver. It stems from improper handling of objects in memory, enabling a local attacker to escalate privileges on a vulnerable system. Public references consistently describe the CLFS driver...

CVE-2019-0863

CVE-2019-0863 is a Windows Elevation of Privilege vulnerability in Windows Error Reporting (WER) where the vulnerability stems from the way WER handles files. The underlying issue allows local attackers to escalate to kernel-level privileges (CVE-2019-0863). Microsoft patched this in the May 2019...

CVE-2022-22047

CVE-2022-22047 is a Windows CSRSS Elevation of Privilege vulnerability. The CSRSS component may allow a local attacker who can execute code on the target to gain SYSTEM privileges. Public exploitation has been reported; Microsoft’s July 2022 Patch Tuesday addressed this family of issues (CSRSS Eo...

CVE-2019-0543

Technical details about CVE-2019-0543 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2019-1385

CVE-2019-1385 is a local privilege-escalation vulnerability in Windows AppX Deployment Extensions (AppXSVC). The issue arises from improper privilege management within the AppX Deployment Extensions, enabling an authenticated attacker who runs a specially crafted application to elevate privileges...

CVE-2019-0797

CVE-2019-0797 is a Windows Win32k privilege-escalation vulnerability caused by the Win32k component failing to properly handle objects in memory, enabling local code execution with kernel privileges. Affected: Windows Win32k subsystem (Win32k.sys). Impact: elevated privileges to SYSTEM with poten...

CVE-2020-0938

CVE-2020-0938 affects the Windows Adobe Font Manager Library by improperly handling specially crafted multi-master Font 1 PostScript fonts. The root cause is a vulnerability in the font parser that can allow remote code execution when processing crafted documents. For all Windows versions except ...

CVE-2021-40450

CVE-2021-40450 is a Win32k elevation-of-privilege vulnerability (local, privilege escalation) in Windows. The CVE is described as a Win32k Privilege Escalation issue with high impact (confidentiality, integrity, availability) per CVSS 3.1/3.1 vector; attack is local and requires no user interacti...

CVE-2020-1027

CVE-2020-1027 is a Windows privilege-escalation vulnerability affecting Windows kernel memory handling and the CSRSS subsystem. The Windows kernel path (memory object handling) enabled local privilege escalation via write-what-where style abuse in kernel fault paths, while the CSRSS path allowed ...

CVE-2021-34486

CVE-2021-34486 is a Windows Event Tracing Elevation of Privilege vulnerability. The referenced data identify ETW as the affected component with a local attack vector and privilege escalation impact (CVE severity up to HIGH in CVSS‑3.1). Microsoft and related catalogs describe this as a Windows ET...

CVE-2022-21907

CVE-2022-21907 concerns the HTTP Protocol Stack (http.sys) in Windows, enabling remote code execution via specially crafted packets. Public documentation and PoCs indicate impact on Windows 10 (notably 2004) and Windows Server variants, with multiple exploits and PoCs surfacing publicly. Mitigati...

CVE-2022-34713

CVE-2022-34713 (DogWalk) is a remote code execution vulnerability in Microsoft Windows MSDT that is triggered when MSDT is invoked via the URL protocol from a calling application (e.g., Word). The CVSS 3.1 entry indicates a local attack vector with low attack complexity, no privileges required, b...

CVE-2020-0638

CVE-2020-0638 is a Windows Update Notification Manager elevation-of-privilege vulnerability. An attacker who already has code execution on the target could exploit the flaw by running a crafted program to elevate privileges, due to how the Update Notification Manager handles files. The issue is l...

CVE-2019-0903

Technical details about CVE-2019-0903 (affected component/version/root cause/impact) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-36802

CVE-2023-36802 is an Elevation of Privilege vulnerability in the Microsoft Streaming Service Proxy (MSKSSRV.SYS). The connected documents identify the root cause as an object type confusion in the Windows kernel-mode driver, enabling local privilege escalation to SYSTEM on vulnerable Windows 10/1...

CVE-2019-1129

CVE-2019-1129 is a Windows AppX Deployment Service (AppXSVC) privilege-escalation vulnerability caused by improper handling of hard links. The issue enables local Privilege Escalation with high impact; CVSS 3.1 base score 7.8 (LOCAL, LOW complexity, no user interaction) as documented by NVD, and ...

CVE-2024-38063

CVE-2024-38063 is a Windows IPv6/tcpip.sys vulnerability involving improper handling of IPv6 extension headers and fragmentation. Technical material in connected docs shows an integer underflow in the IPv6 fragment reassembly path (Ipv6pReassemblyTimeout) and a risky code path where IppSendErrorL...

CVE-2020-17049

CVE-2020-17049 is a Kerberos KDC service-ticket delegation bypass in IBM Application Gateway, enabling a compromised service using Kerberos Constrained Delegation to tamper with service tickets and force KDC acceptance. The vulnerability affects IBM Application Gateway versions 19.12–24.06. IBM’s...

CVE-2018-8611

CVE-2018-8611 – Windows kernel elevation of privilege . The vulnerability arises because the Windows kernel fails to properly handle objects in memory, enabling a local attacker to run arbitrary code in kernel mode and perform actions such as installing programs, changing data, or creating accoun...

CVE-2025-21298

CVE-2025-21298 is a Windows OLE use-after-free memory corruption vulnerability in ole32.dll (UtOlePresStmToContentsStm) that enables remote code execution via specially crafted RTF, including zero-click scenarios when previews are shown in Outlook. The issue arises from a double-free of the CONTE...

CVE-2023-21674

CVE-2023-21674 affects Windows Advanced Local Procedure Call (ALPC). The documented root cause is an Elevation of Privilege in ALPC that could enable browser sandbox escape and gain SYSTEM privileges. Public exploits exist (Kaspersky notes exploitation in the wild; a GitHub PoC is referenced), in...

CVE-2022-37969

CVE-2022-37969 is a local privilege escalation in Windows CLFS (clfs.sys). The provided connected exploit discussion describes an out-of-bounds/memory-spraying chain that corrupts CLFS kernel structures (notably pContainer in a CLFS container) via crafted .blf files and memory spraying, enabling ...

CVE-2022-41128

CVE-2022-41128 is a Windows Scripting Languages Remote Code Execution vulnerability in the JScript9 scripting language. Reports consistently describe a network-exploitable RCE where visiting a malicious site can trigger memory corruption and arbitrary code execution on affected Windows systems. E...

CVE-2022-38023

CVE-2022-38023 (NetLogon RC4-HMAC vulnerability) affects Samba and related packages (samba, samba-client, libsmbclient, libwbclient, etc.). Technical detail: the issue stems from allowing RC4/HMAC-MD5 in the NetLogon Secure Channel, weakening authentication between clients and servers. Affected p...

CVE-2019-1388

CVE-2019-1388 is a Windows local privilege-escalation vulnerability in the Certificate Dialog caused by improper enforcement of user privileges. Public data shows CVSS v3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW privilege requirements, no user interaction, and high impact to confiden...

CVE-2022-41033

CVE-2022-41033 is a Windows Privilege Escalation affecting the COM+ Event System Service. The root cause is an improper privilege handling in the service, enabling a local attacker with low privileges to obtain SYSTEM level access, compromising confidentiality, integrity, and availability. The CV...

CVE-2023-24880

CVE-2023-24880 is a Windows SmartScreen Security Feature Bypass vulnerability. The Connected sources describe MOTW bypass via crafted files that can defeat SmartScreen/Protected View, enabling execution of malicious code without proper MOTW checks. Exploitation in the wild is mentioned in multipl...

CVE-2023-21823

CVE-2023-21823 (Windows Graphics Component RCE) : A Windows Graphics Component remote code execution vulnerability that can give an attacker SYSTEM-level code execution when exploited. Public discussion across sources notes exploitation risk and active exploitation in the wild around Patch Tuesda...

CVE-2022-41073

CVE-2022-41073 — Windows Print Spooler Elevation of Privilege affects Windows Print Spooler. Connected docs note exploitation in the wild and public patching via Microsoft updates (Nov 2022 Patch Tuesday). Remediation is to apply the Microsoft update for CVE-2022-41073 per MSRC/update guidance in...

CVE-2022-41091

CVE-2022-41091 is a Windows security feature bypass in Mark of the Web (MOTW). The vulnerability allows bypassing MOTW protections, with a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L). Public sources note exploitation in the wild and patches are delivered via Microsoft’s upda...

CVE-2022-41049

CVE-2022-41049 refers to a Windows Mark of the Web (MotW) security feature bypass vulnerability. Affected: Windows MotW handling; Root cause: bypass of MotW checks that normally protect against untrusted content. Impact: limited loss of integrity and availability of security features; exploitatio...

CVE-2024-38124

CVE-2024-38124 is a Windows Netlogon Elevation of Privilege vulnerability. The provided exploitation context shows an attacker with network access on an AD domain can craft Netlogon messages to impersonate machines (including DCs), enabling privilege escalation and potential full AD compromise. A...

CVE-2022-41125

CVE-2022-41125 affects Windows CNG Key Isolation Service (Windows Cryptographic Next Generation). The underlying issue is an Elevation of Privilege in that service, enabling an authenticated attacker to gain SYSTEM privileges. Patch guidance is to install the Microsoft updates for this CVE (per M...

CVE-2024-21338

CVE-2024-21338 is a Windows kernel local privilege escalation caused by an exposed IOCTL with insufficient access control in the appid.sys component. The vulnerability enables local attackers with LOW privileges and no user interaction to escalate to kernel to access high-privilege operations (CV...

CVE-2023-36563

CVE-2023-36563 refers to a Microsoft WordPad Information Disclosure vulnerability. The connected materials confirm that exploitation could disclose NTLM hashes when a user opens a specially crafted file or if an attacker has access to the host, with signs of exploitation in the wild cited by Patc...

CVE-2025-29824

CVE-2025-29824 is a Use-After-Free vulnerability in the Windows Common Log File System Driver (CLFS) kernel driver, caused by a race condition in W32PROCESS handling via WaitForInputIdle that enables local privilege escalation to SYSTEM. Microsoft patched this in April 2025 (KB5044284). Public ex...