CVSS: 7.2EPSS: 0%CPEs: 11EXPL: 2CVE-2015-0004 – Microsoft Windows < 8.1 (x86/x64) - User Profile Service Privilege Escalation (MS15-003)
https://notcve.org/view.php?id=CVE-2015-0004
The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability." User Profile Service (también conocido como ProfSvc) en Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 permite a usuarios locales ganar privilegios mediante la realización de un ataque de cruces para cargar el hive del registro UsrClass.dat de otro usuario, tambieán conocido como MSRC ID 20674 o 'vulnerabilidad de la elevación de privilegios de Microsoft User Profile Service.' Windows suffers from an elevation of privilege vulnerability in the User Profile Service. • https://www.exploit-db.com/exploits/35811 http://secunia.com/advisories/61927 http://www.securityfocus.com/bid/71967 https://code.google.com/p/google-security-research/issues/detail?id=123 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-003 https://exchange.xforce.ibmcloud.com/vulnerabilities/99519 https://exchange.xforce.ibmcloud.com/vulnerabilities/99520 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2015-0006
https://notcve.org/view.php?id=CVE-2015-0006
The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability." El servicio Network Location Awareness (NLA) de Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, y Windows Server 2012 Gold y R2 no realiza autenticación recíproca para determinar un dominio de conexión, lo que permite atacantes remotos lanzar una configuración permisiva no intencionada mediante suplantación de DNS y respuestas LDAP en la red local, también conocido como 'NLA Security Feature Bypass Vulnerability.' • http://secunia.com/advisories/62098 http://secunia.com/advisories/62184 http://www.securityfocus.com/bid/71930 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-005 https://exchange.xforce.ibmcloud.com/vulnerabilities/99521 https://exchange.xforce.ibmcloud.com/vulnerabilities/99522 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 2CVE-2015-0002 – Microsoft Windows 8.1 (x86/x64) - 'ahcache.sys' NtApphelpCacheControl Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-0002
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability." La función AhcVerifyAdminContext en ahcache.sys en el componente Application Compatibility en Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 no verifica que un token de suplantación está asociado con una cuenta administrativa, lo que permite a usuarios locales ganar privilegios mediante la activación de AppCompatCache.exe con un fichero DLL manipulado, también conocido como MSRC ID 20544 o 'vulnerabilidad de la elevación de privilegios de la infraestructura de la compatibilidad de aplicaciones de Microsoft.' • https://www.exploit-db.com/exploits/35661 http://secunia.com/advisories/61277 http://twitter.com/sambowne/statuses/550384131683520512 http://www.securityfocus.com/bid/71972 http://www.zdnet.com/article/google-discloses-unpatched-windows-vulnerability https://code.google.com/p/google-security-research/issues/detail?id=118 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/99523 https://exchange.xforce.ibmcloud.com/vulner • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 1.9EPSS: 0%CPEs: 6EXPL: 0CVE-2015-0001 – Microsoft Windows 8.1 Ahcache.sys/NtApphelpCacheControl Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-0001
The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability." El componente Windows Error Reporting (WER) en Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 permite a usuarios locales evadir el mecanismo de protección Protected Process Light y leer el contenido de localizaciones de la memoria de procesos arbitrarias mediante el aprovechamiento de privilegios de administración, también conocido como 'vulnerabilidad de la evasión de la caracteristica de seguridad de los informes sobre errores de Windows.' On Windows 8.1 Update 32/64 bit, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext. • http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html http://secunia.com/advisories/62134 http://www.securityfocus.com/bid/71927 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-006 https://exchange.xforce.ibmcloud.com/vulnerabilities/99513 https://exchange.xforce.ibmcloud.com/vulnerabilities/99514 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.7EPSS: 0%CPEs: 10EXPL: 0CVE-2015-0011
https://notcve.org/view.php?id=CVE-2015-0011
mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability." mrxdav.sys (también conocido como el controlador WebDAV) en los controladores del modo kernel en Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 permite a usuarios locales evadir el mecanismo de protección de la suplantación, y obtener privilegios para la redirección de solicitudes WebDAV, a través de una aplicación manipulada, también conocido como 'vulnerabilidad de la elevación de privilegios de WebDAV.' • http://secunia.com/advisories/62154 http://www.securityfocus.com/bid/71960 http://www.securitytracker.com/id/1031531 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-008 https://exchange.xforce.ibmcloud.com/vulnerabilities/99526 https://exchange.xforce.ibmcloud.com/vulnerabilities/99527 • CWE-264: Permissions, Privileges, and Access Controls •