Latest Privilege Escalation news

Zero-Day Flaw in Windows 10 Task Scheduler Gets Micropatch

An unpatched local privilege escalation zero-day vulnerability in Windows 10 received a temporary patch today. The fix is delivered through the 0patch platform and can be applied on systems without rebooting them..
- Ionut Ilascu
- May 31, 2019
- 12:23 PM
- 0
Thousands of WordPress Sites Exposed by Yellow Pencil Plugin Flaw

The Yellow Pencil Visual Theme Customizer plugin was removed on Monday from the WordPress.org repository because of a privilege escalation bug which would have allowed potential attackers to update arbitrary options on vulnerable installations.
- Sergiu Gatlan
- April 12, 2019
- 10:46 AM
- 0
Demo Exploit Code Available for Privilege Escalation Bug in Windows

Proof-of-concept exploit code for a privilege escalation vulnerability affecting Windows operating system has been published today, soon after Microsoft rolled out its monthly batch of security patches.
- Ionut Ilascu
- April 10, 2019
- 03:35 AM
- 0
Apache Bug Lets Normal Users Gain Root Access Via Scripts

A privilege escalation vulnerability of important severity in the Apache HTTP server allowing users with the right to write and run scripts to gain root on Unix systems was fixed in Apache httpd 2.4.39.
- Sergiu Gatlan
- April 02, 2019
- 09:51 AM
- 0
Intel Fixes High Severity Vulnerabilities in Graphics Driver for Windows

Intel fixed 20 security vulnerabilities in the Intel Graphics Driver for Windows which would lead to escalation of privilege, denial of service, or information disclosure if exploited by attackers with local access to the system under attack.
- Sergiu Gatlan
- March 14, 2019
- 02:39 PM
- 0
Google Advises Upgrade to Windows 10 to Fix Windows 7 Zero-Day Bug

Google recommends users of Windows 7 to give it up and move to Microsoft's latest operating system if they want to keep systems safe from a zero-day vulnerability exploited in the wild.
- Ionut Ilascu
- March 07, 2019
- 07:01 PM
- 9
New Elevation of Privilege Vulnerability Found in Cisco WebEx Meetings

A vulnerability found in the update service of the Cisco Webex Meetings Desktop App for Windows could allow an unprivileged local attacker to elevate privileges and run arbitrary commands using the SYSTEM user privileges.
- Sergiu Gatlan
- February 27, 2019
- 11:00 AM
- 0
Canonical Snapd Vulnerability Gives Root Access in Linux

A researcher has discovered a new vulnerability called "Dirty_Sock" in the REST API for Canonical's snapd daemon that can allow attackers to gain root access on Linux machines. To illustrate how these vulnerabilities can be exploited, the researcher has released to PoCs that use different methods to elevate privileges.
- Lawrence Abrams
- February 13, 2019
- 04:15 AM
- 0
Check Point Fixes Privilege Escalation Bug in ZoneAlarm Free

A security issue in Check Point's free edition of ZoneAlarm antivirus and firewall solution allowed a user with limited rights on the machine to inject and execute code with the highest privileges.
- Ionut Ilascu
- January 24, 2019
- 01:13 PM
- 0
Windows Zero-Day PoC Lets You Read Any File with System Level Access

For a third time in four months, a security researcher announces a zero-day vulnerability in Microsoft Windows and provides exploit code that allows reading into unauthorized locations.
- Ionut Ilascu
- December 20, 2018
- 11:46 AM
- 2
Keybase Pays $5,000 Bounties for Privilege Escalation Bugs in Linux and macOS Apps

Keybase received two separate reports for security issues in its app for Linux and macOS that led to privilege escalation on the system. For each of them, the developer paid a bounty of $5,000.
- Ionut Ilascu
- December 20, 2018
- 02:56 AM
- 0
ASUS, GIGABYTE Drivers Contain Code Execution Vulnerabilities - PoCs Galore

Four drivers from ASUS and GIGABYTE come with several vulnerabilities that can be leveraged by an attacker to gain higher permissions on the system and to execute arbitrary code.
- Ionut Ilascu
- December 18, 2018
- 04:03 PM
- 0
Exploit Code for the Kubernetes Flaw Is Now Available

The recently disclosed critical-impact bug in Kubernetes created strong ripples in the security world of the container-orchestration system. Now, multiple demo exploits exist and come with easy-to-understand explanations.
- Ionut Ilascu
- December 10, 2018
- 08:06 AM
- 0
Kubernetes Updates Patch Critical Privilege Escalation Bug

A critical vulnerability in Kubernetes open-source system for handling containerized applications can enable an attacker to gain full administrator privileges on Kubernetes compute nodes.
- Ionut Ilascu
- December 04, 2018
- 11:12 AM
- 0
Vulnerability in AMP for WP Plugin Allowed Admin Access to WordPress

A vulnerability for the very popular AMP for WP WordPress plugin with a 100 thousand active installations was discovered that allows any registered users to escalate their privileges to gain administrative access to the site.
- Lawrence Abrams
- November 19, 2018
- 11:14 AM
- 0
November Android Security Update Fixes Critical Bugs, Drops Media Library

Google released to all users and partners its November security bulletin for the Android operating system, with fixes for critical remote code execution (RCE) and privilege escalation vulnerabilities.
- Ionut Ilascu
- November 07, 2018
- 06:51 AM
- 0
WordPress Design Flaw + WooCommerce Vulnerability Leads to Site Takeover

A design flaw in the WordPress permission system used by plugins and a file deletion vulnerability in a very popular eCommerce plugin called WooCommerce could allow attackers to gain full control over a WordPress site.
- Lawrence Abrams
- November 06, 2018
- 04:22 PM
- 1
Trivial Bug in X.Org Gives Root Permission on Linux and BSD Systems

A vulnerability that is trivial to exploit allows privilege escalation to root level on Linux and BSD distributions using X.Org server, the open source implementation of the X Window System that offers the graphical environment.
- Ionut Ilascu
- October 26, 2018
- 12:11 PM
- 1
Privilege Escalation Bug Found in Popular VPN Clients

Vulnerabilities in NordVPN and ProtonVPN clients allow an attacker to execute code on the affected computer with the rights of an administrator.
- Ionut Ilascu
- September 07, 2018
- 05:52 PM
- 2
New "Turning Tables" Technique Bypasses All Windows Kernel Mitigations

Security researchers have discovered a new exploitation technique that they say can bypass the kernel protection measures present in the Windows operating systems.
- Catalin Cimpanu
- August 20, 2018
- 10:55 AM
- 0