Base de CVEs

CVE-2021-41379 Média · 5.5 KEV Alta · 63 Ransomware CWE-59 09/11/2021

Microsoft Windows Installer Privilege Escalation Vulnerability

Windows Installer Elevation of Privilege Vulnerability

CVE-2021-28153 Média · 5.3 CWE-59 11/03/2021

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with...

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

CVE-2019-20383 Alta · 7.8 CWE-59 13/08/2020

Link Following em Abbyy Finereader

ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.

CVE-2020-0787 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-59 12/03/2020

Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

CVE-2020-0683 Alta · 7.8 KEV Alta · 69 Exploit público CWE-59 11/02/2020

Microsoft Windows Installer Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

CVE-2020-0638 Alta · 7.8 KEV Alta · 64 Ransomware CWE-59 14/01/2020

Microsoft Update Notification Manager Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.

CVE-2019-1385 Alta · 7.8 KEV Alta · 64 Ransomware CWE-59 12/11/2019

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.

CVE-2019-1315 Alta · 7.8 KEV Urgente · 70 Exploit público Ransomware CWE-59 10/10/2019

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.

CVE-2019-1253 Alta · 7.8 KEV Urgente · 79 Exploit público Ransomware CWE-59 11/09/2019

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

CVE-2019-1130 Alta · 7.8 KEV Alta · 63 Ransomware CWE-59 15/07/2019

Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.

CVE-2019-1129 Alta · 7.8 KEV Alta · 63 Ransomware CWE-59 15/07/2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.

CVE-2019-1064 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-59 12/06/2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.

CVE-2019-1069 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-59 12/06/2019

Microsoft Task Scheduler Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

CVE-2019-0841 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-59 09/04/2019

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

CVE-2017-12172 Média · 6.7 CWE-59 22/11/2017

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x...

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

CVE-2015-5287 Alta · 7.8 KEV Urgente · 75 Exploit público CWE-59 07/12/2015

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVE-2015-1130 Alta · 7.8 KEV Urgente · 75 Exploit público CWE-59 10/04/2015

Apple OS X Authentication Bypass Vulnerability

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.