CVSS: 9.3EPSS: 4%CPEs: 15EXPL: 0CVE-2019-0790
https://notcve.org/view.php?id=CVE-2019-0790
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795. Existe una vulnerabilidad de ejecución de código remota cuando el analizador MSXML de Microsoft XML Core Services procesa la entrada de usuario, también se conoce como “MS XML Remote Code Execution Vulnerability”. Este ID de CVE es diferente a los CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795. • http://www.securityfocus.com/bid/107702 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0790 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2019-0764
https://notcve.org/view.php?id=CVE-2019-0764
A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'. Existe una vulnerabilidad de manipulación cuando los exploradores de Microsoft no comprueban correctamente la entrada en condiciones específicas, también se conoce como “Microsoft Browsers Tampering Vulnerability". • http://www.securityfocus.com/bid/107731 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0764 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 1CVE-2019-0732 – Microsoft Windows 10 1809 - LUAFV NtSetCachedSigningLevel Device Guard Bypass
https://notcve.org/view.php?id=CVE-2019-0732
A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'. En Windows existe una vulnerabilidad de omisión de la característica de seguridad, que podría permitir a un atacante eludir Device Guard, debido a que Windows maneja de forma incorrecta las llamadas al controlador LUAFV (luafv.sys), también conocido como 'Vulnerabilidad de omisión de la característica de seguridad de Windows'. On Microsoft Windows, the NtSetCachedSigningLevel system call can be tricked by the operation of LUAFV to apply a cached signature to an arbitrary file leading to a bypass of code signing enforcement under UMCI with Device Guard. • https://www.exploit-db.com/exploits/46716 http://packetstormsecurity.com/files/152536/Microsoft-Windows-LUAFV-NtSetCachedSigningLevel-Device-Guard-Bypass.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0732 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 1CVE-2019-0730 – Microsoft Windows 10 1809 - LUAFV Delayed Virtualization MAXIMUM_ACCESS DesiredAccess Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-0730
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841. Existe una vulnerabilidad de elevación de de privilegios en Windows, debido a que maneja de forma incorrecta las llamadas al controlador LUAFV (luafv.sys), también conocido como 'vulnerabilidad de elevación de privilegios de Windows'. Este CVE ID es único de CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841. On Microsoft Windows, the LUAFV driver reuses the file's create request DesiredAccess parameter, which can include MAXIMUM_ACCESS, when virtualizing a file resulting in elevation of privilege. • https://www.exploit-db.com/exploits/46713 http://packetstormsecurity.com/files/152533/Microsoft-Windows-LUAFV-Delayed-Virtualization-MAXIMUM_ACCESS-DesiredAccess-Privilege-Escalation.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0730 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 1CVE-2019-0731 – Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cross Process Handle Duplication Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-0731
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841. Existe una vulnerabilidad de elevación de privilegios en Windows, debido a que maneja incorrectamente las llamadas al controlador LUAFV (luafv.sys), también conocido como 'vulnerabilidad de elevación de privilegio de Windows'. Este CVE ID es único de CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841. On Microsoft Windows, the LUAFV driver doesn't take into account a virtualized handle being duplicated to a more privileged process resulting in elevation of privilege. • https://www.exploit-db.com/exploits/46714 http://packetstormsecurity.com/files/152534/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cross-Process-Handle-Duplication-Privilege-Escalation.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0731 • CWE-264: Permissions, Privileges, and Access Controls •