Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script to the WSNativePushService.exe
Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary.
The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. VDB-251670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
An Uncontrolled Resource Consumption vulnerability has been found on Sandsprite Scdbg.exe, affecting version 1.0. This vulnerability allows an attacker to send a specially crafted shellcode payload to the '/foff' parameter and cause an application shutdown. A malware program could use this shellcode sequence to shut down the application and evade the scan.
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.
One Identity Password Manager versions prior to 5.13.1 contain a vulnerability that allows users to escape the Chromium-based Kiosk mode used for Active Directory password resets. By exploiting a sequence involving the Google ReCAPTCHA privacy link, an attacker can open a new browser window, navigate to a file upload site, access the Windows file explorer, and launch cmd.exe with SYSTEM privileges.
A buffer overflow vulnerability exists in osslsigncode version 2.3 and earlier. This flaw allows a local attacker to execute arbitrary code by crafting malicious .exe, .sys, or .dll files. The vulnerability affects versions up to and including 2.3. No CVSS score is provided for this issue.
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.
This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.
CVE-2014-4077 is a privilege escalation vulnerability in Microsoft Input Method Editor (IME) Japanese, specifically involving the IMJPDCT.EXE component. This vulnerability allows attackers to bypass sandbox restrictions and escalate privileges on affected Windows systems. The IME Japanese keyboard is included by default in Windows but is disabled by default. Exploitation of this vulnerability has been observed in the wild.
CVE-2019-0880 is a local privilege escalation vulnerability in Microsoft Windows involving the splwow64.exe process. Exploitation allows an attacker to elevate privileges from low-integrity to medium-integrity on an affected system. This vulnerability has been observed exploited in the wild.
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur
A vulnerability in the smss.exe debugging subsystem of Microsoft Windows allows local users to escalate privileges to administrator or SYSTEM level by exploiting improper authentication of inter-process connections.
CVE-2019-18935 is a deserialization of untrusted data vulnerability in Progress Telerik UI for ASP.NET AJAX, specifically through the RadAsyncUpload component. This flaw allows remote code execution on the server within the w3wp.exe process. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
Docker Desktop Community Edition contains a local privilege escalation vulnerability where an attacker can place a malicious docker-credential-wincred.exe file in a specific directory to escalate privileges.