Latest Privilege Escalation news

Latest macOS Big Sur also has SUDO root privilege escalation flaw

Recently discovered Linux SUDO privilege escalation vulnerability, CVE-2021-3156 (aka Baron Samedit) also impacts the latest Apple macOS Big Sur with no patch available yet.
- Ax Sharma
- February 03, 2021
- 06:00 AM
- 0
Windows Installer zero-day vulnerability gets free micropatch

A vulnerability in the Windows Installer component, which Microsoft attempted to fix several times to no avail, today received a micropatch to deny hackers the option of gaining the highest privileges on a compromised system.
- Ionut Ilascu
- January 29, 2021
- 03:33 AM
- 1
New Linux SUDO flaw lets local users gain root privileges

A now-fixed Sudo vulnerability allowed any local user to gain root privileges on Unix-like operating systems without requiring authentication.
- Sergiu Gatlan
- January 26, 2021
- 02:39 PM
- 4
Windows PsExec zero-day vulnerability gets a free micropatch

A free micropatch fixing a local privilege escalation (LPE) vulnerability in Microsoft's Windows PsExec management tool is now available through the 0patch platform.
- Sergiu Gatlan
- January 07, 2021
- 03:41 PM
- 0
CrowdStrike releases free Azure security tool after failed hack

Leading cybersecurity firm CrowdStrike was notified by Microsoft that threat actors had attempted to read the company's emails through compromised by Microsoft Azure credentials.
- Lawrence Abrams
- December 25, 2020
- 02:08 PM
- 0
Windows zero-day with bad patch gets new public exploit code

Back in June, Microsoft released a fix for a vulnerability in the Windows operating system that enabled attackers to increase their permissions to kernel level on a compromised machine. The patch did not stick.
- Ionut Ilascu
- December 23, 2020
- 02:57 PM
- 0
Windows 7 and Server 2008 zero-day bug gets a free patch

An unpatched local privilege escalation (LPE) vulnerability affecting all Windows 7 and Server 2008 R2 devices received a free and temporary fix today through the 0patch platform.
- Sergiu Gatlan
- November 25, 2020
- 12:55 PM
- 3
VMWare releases fix for critical ESXi, Workstation vulnerability

VMware has released security updates to fix critical and high severity vulnerabilities in VMware ESXi, Workstation, Fusion, and Cloud Foundation, allowing for code execution and privilege escalation.
- Sergiu Gatlan
- November 20, 2020
- 01:22 PM
- 0
NVIDIA fixes severe flaw in GeForce NOW cloud gaming service

NVIDIA released a security update for the GeForce Now cloud gaming Windows app to address a vulnerability that could allow attackers to execute arbitrary code or escalate privileges on systems running unpatched software.
- Sergiu Gatlan
- November 11, 2020
- 11:40 AM
- 0
Microsoft fixes Windows zero-day disclosed by Google last month

Microsoft has fixed today a Windows kernel zero-day vulnerability exploited in the wild as part of targeted attacks and publicly disclosed by Project Zero, Google's 0day bug-hunting team, last month.
- Sergiu Gatlan
- November 10, 2020
- 01:50 PM
- 0
Ubuntu's Gnome desktop could be tricked into giving root access

A vulnerability in GNOME Display Manager (gdm) could allow a standard user to create accounts with increased privileges, giving a local attacker a path to run code with administrator permissions (root).
- Ionut Ilascu
- November 10, 2020
- 11:41 AM
- 3
WordPress plugin bugs can let attackers hijack up to 100K sites

Admins of WordPress sites who use the Ultimate Member plugin are urged to update it to the latest version to block attacks attempting to exploit multiple critical and easy to exploit vulnerabilities that could lead to site takeovers.
- Sergiu Gatlan
- November 09, 2020
- 06:29 PM
- 0
Windows kernel zero-day vulnerability used in targeted attacks

Project Zero, Google's 0day bug-hunting team, today disclosed a zero-day elevation of privileges (EoP) vulnerability found in the Windows kernel and actively exploited in targeted attacks.
- Sergiu Gatlan
- October 30, 2020
- 01:38 PM
- 0
Microsoft warns of ongoing attacks using Windows Zerologon flaw

Microsoft today warned that threat actors are continuing to actively exploit systems unpatched against the ZeroLogon privilege escalation vulnerability in the Netlogon Remote Protocol (MS-NRPC).
- Sergiu Gatlan
- October 29, 2020
- 04:46 PM
- 0
Ransomware gang now using critical Windows flaw in attacks

Microsoft is warning that cybercriminals have started to incorporate exploit code for the ZeroLogon vulnerability in their attacks. The alert comes after the company noticed ongoing attacks from cyber-espionage group MuddyWater (SeedWorm) in the second half of September.
- Ionut Ilascu
- October 09, 2020
- 03:33 AM
- 0
HP Device Manager backdoor lets attackers take over Windows systems

HP released a security advisory detailing three critical and high severity vulnerabilities in the HP Device Manager that could lead to system takeover.
- Sergiu Gatlan
- October 02, 2020
- 02:24 PM
- 0
NVIDIA fixes high severity flaws in Windows display driver

NVIDIA has released security updates to address high severity vulnerabilities in the Windows GPU display driver that could lead to code execution, escalation of privileges, information disclosure, and denial of service.
- Sergiu Gatlan
- October 01, 2020
- 02:08 PM
- 0
Microsoft: Hackers using Zerologon exploits in attacks, patch now!

Microsoft has warned that attackers are actively using the Windows Server Zerologon exploits in attacks and advises all Windows administrators to install the necessary security updates.
- Lawrence Abrams
- September 23, 2020
- 11:51 PM
- 0
Windows Zerologon PoC exploits allow domain takeover. Patch Now!

Researchers have released exploits for the Windows Zerologon CVE-2020-1472 vulnerability that allow an attacker to take control of a Windows domain. Install patches now!
- Lawrence Abrams
- September 15, 2020
- 04:31 PM
- 3
Intel fixes critical flaw in corporate remote management platform

Intel today addressed nine security vulnerabilities with the release of the September 2020 Platform Update, one of them being a critical flaw impacting the Active Management Technology (AMT) and Intel Standard Manageability (ISM) platforms.
- Sergiu Gatlan
- September 08, 2020
- 03:26 PM
- 3