An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. By default, these executable files are downloaded to and run from the %TEMP% directory of the currently logged on user, despite the fact that the SecureConnector agent is running as SYSTEM. Aside from the downloaded scripts, the SecureConnector agent runs a batch file with SYSTEM privileges from the temp directory of the currently logged on user. If the naming convention of this script can be derived, which is made possible by placing it in a directory to which the user has read access, it may be possible overwrite the legitimate batch file with a malicious one before SecureConnector executes it. It is possible to change this directory by setting the the configuration property config.script_run_folder.value in the local.properties configuration file on the CounterACT management appliance, however the batch file which is run does not follow this property.

Windows Event Tracing Elevation of Privilege Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Windows UPnP Device Host Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

Azure Sphere Unsigned Code Execution Vulnerability

Windows Hyper-V Remote Code Execution Vulnerability

Windows Fast FAT File System Driver Elevation of Privilege Vulnerability

Storage Spaces Direct Elevation of Privilege Vulnerability

Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability

Microsoft splwow64 Elevation of Privilege Vulnerability

Windows WLAN Service Elevation of Privilege Vulnerability

Windows Update Stack Setup Elevation of Privilege Vulnerability

Windows CSC Service Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Windows CSC Service Elevation of Privilege Vulnerability

Windows Win32k Elevation of Privilege Vulnerability

Windows Event Logging Service Elevation of Privilege Vulnerability

Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability

Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability

Windows Hyper-V Elevation of Privilege Vulnerability

Microsoft Defender Remote Code Execution Vulnerability

Windows InstallService Elevation of Privilege Vulnerability

Windows CSC Service Elevation of Privilege Vulnerability

Windows Fax Service Elevation of Privilege Vulnerability

Active Template Library Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Windows CSC Service Elevation of Privilege Vulnerability

Windows Fax Compose Form Remote Code Execution Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Windows CSC Service Elevation of Privilege Vulnerability

Windows Runtime C++ Template Library Elevation of Privilege Vulnerability

Windows TCP/IP Driver Elevation of Privilege Vulnerability

Azure RTOS Elevation of Privilege Vulnerability

Storage Spaces Controller Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Storage Spaces Controller Elevation of Privilege Vulnerability

A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard, aka ".NET Framework Device Guard Security Feature Bypass Vulnerability." This affects Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 2.0, Microsoft .NET Framework 4.6/4.6.1/4.6.2.

An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

Windows Telephony Server Elevation of Privilege Vulnerability

Windows CD-ROM Driver Elevation of Privilege Vulnerability

An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hub Standard Collector Elevation Of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Microsoft Visual Studio, Windows 10 Servers.

Windows Fax and Scan Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

Windows Security Support Provider Interface Elevation of Privilege Vulnerability