CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows CryptoAPI Elliptic Curve Cryptography (ECC) Certificate Validation Bypass Vulnerability (CVE-2020-0601, CurveBall)
[Affected Scope] Microsoft Windows 10, Windows Server 2016, and Windows Server 2019 systems utilizing the Crypt32.dll library.
[Impact] Attackers can spoof code-signing certificates to execute malicious binaries as trusted software, or perform Man-in-the-Middle (MitM) attacks to decrypt HTTPS traffic.
[Mitigation] Apply the official Microsoft security updates immediately and monitor network traffic for non-standard ECC parameters.
Windows Win32k Kernel Memory Handling Local Privilege Escalation Vulnerability (CVE-2019-1458) Analysis and Mitigation Guide
[Affected Scope] Windows 7, 8.1, 10 and Windows Server 2008, 2012, 2016, 2019 utilizing the Win32k subsystem
[Impact] A local attacker can execute arbitrary code in kernel mode (SYSTEM privileges), completely bypassing security controls and compromising the host
[Mitigation] Immediately apply the official Microsoft cumulative security updates (KB) and restrict unauthorized local executable execution
Windows UPnP Service COM Object Creation Local Privilege Escalation (CVE-2019-1405) Technical Analysis and Hardening Guide
[Affected Scope] Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 with active UPnP services
[Impact] A local authenticated attacker can exploit improper COM object instantiation to execute arbitrary code with NT AUTHORITY\SYSTEM privileges
[Mitigation] Apply the official Microsoft security updates immediately, or disable the UPnP Device Host service as a temporary workaround
Windows Certificate Dialog Elevation of Privilege Vulnerability (CVE-2019-1388) Deep Dive & Mitigation Guide
[Affected Scope] Multiple legacy Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019
[Impact] A local authenticated attacker can bypass User Account Control (UAC) and execute arbitrary code with NT AUTHORITY\SYSTEM privileges by exploiting a design flaw in the Windows Certificate Dialog
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict UAC behavior and standard user privileges if patching is delayed
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability (CVE-2019-1385) Analysis and Mitigation Guide
[Affected Scope] Windows AppX Deployment Extensions component running on Windows 10 and Windows Server environments.
[Impact] An authenticated local attacker can execute a specially crafted application to access system files, leading to full SYSTEM privilege escalation.
[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict symbolic link creation privileges for non-administrative users.
Microsoft Windows UPnP Service Local Privilege Escalation Vulnerability (CVE-2019-1322) Analysis and Mitigation Guide
[Affected Scope] Multiple versions of Windows operating systems, including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019
[Impact] A local authenticated attacker with low privileges can exploit improper authentication handling in the UPnP service to execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Apply the official Microsoft security patches immediately, or disable the UPnP Device Host service and block associated ports as a temporary workaround
Windows Error Reporting (WER) Hard Link Elevation of Privilege Vulnerability (CVE-2019-1315)
[Affected Scope] Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 with Windows Error Reporting (WER) enabled
[Impact] A local attacker can exploit hard links to overwrite or manipulate arbitrary system files, leading to arbitrary code execution with SYSTEM privileges
[Mitigation] Immediately apply the official Microsoft security patches and restrict local write permissions on temporary directories prior to patching
Microsoft Internet Explorer Scripting Engine Memory Corruption Remote Code Execution Vulnerability (CVE-2019-1367)
[Affected Scope] Windows client and server environments utilizing Internet Explorer 9, 10, and 11
[Impact] Attackers can execute arbitrary code in the context of the current user via a crafted webpage, potentially gaining full control of the system
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict access to the vulnerable JScript.dll library as a temporary workaround
Windows AppX Deployment Server (AppXSvc) Elevation of Privilege Vulnerability via Junction Handling (CVE-2019-1253)
[Affected Scope] Windows AppX Deployment Service (AppXSvc) running on affected Windows 10 and Windows Server environments
[Impact] Local attackers can exploit improper junction link handling to elevate privileges to NT AUTHORITY\SYSTEM, leading to complete system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict symbolic link creation privileges
Windows Winsock Driver (ws2ifsl.sys) Elevation of Privilege Vulnerability (CVE-2019-1215) Technical Advisory
[Affected Scope] Windows 7, 8.1, 10 and Windows Server 2008, 2012, 2016, 2019 utilizing the ws2ifsl.sys driver
[Impact] Local attackers can execute arbitrary code in kernel mode, leading to complete system takeover and local privilege escalation to SYSTEM
[Mitigation] Apply the official Microsoft security updates immediately and monitor for anomalous Winsock driver calls
Windows CLFS (Common Log File System) Driver Elevation of Privilege Vulnerability (CVE-2019-1214) Technical Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 utilizing the CLFS driver
[Impact] Local attackers can trigger kernel memory corruption to execute arbitrary code with SYSTEM privileges, leading to complete system takeover
[Mitigation] Apply the official Microsoft security patches immediately and monitor for unauthorized local access and anomalous CLFS log file creation
Docker Desktop for Windows Local Privilege Escalation Vulnerability (CVE-2019-15752)
[Affected Scope] Docker Desktop Community Edition versions prior to 2.1.0.1 on Windows platforms
[Impact] Local low-privilege users can execute arbitrary code with administrative or SYSTEM privileges by hijacking credential helper binaries
[Mitigation] Immediately upgrade Docker Desktop to version 2.1.0.1 or later, or restrict write permissions on the vulnerable directory
Windows Win32k Kernel Memory Corruption Local Privilege Escalation Vulnerability (CVE-2019-1132) Analysis & Mitigation Guide
[Affected Scope] Legacy Windows operating systems including Windows 7, Windows Server 2008, and Windows Server 2008 R2 utilizing the Win32k component
[Impact] Local attackers can execute arbitrary code in kernel mode (SYSTEM privileges), completely compromising the host and bypassing security controls
[Mitigation] Immediately apply the official Microsoft cumulative security updates or migrate legacy systems to currently supported Windows versions
Windows AppX Deployment Service (AppXSVC) Hard Link Improper Handling Local Elevation of Privilege Vulnerability (CVE-2019-1130)
[Affected Scope] Microsoft Windows operating systems, including Windows 10 and Windows Server 2016/2019, utilizing the AppX Deployment Service (AppXSVC)
[Impact] A local attacker can execute arbitrary code with SYSTEM privileges by running a specially crafted application, leading to complete system compromise
[Mitigation] Apply the official cumulative security updates provided by Microsoft to correct the file system link handling logic within AppXSVC
Windows AppX Deployment Service (AppXSVC) Elevation of Privilege Vulnerability via Hard Link Mismanagement (CVE-2019-1129)
[Affected Scope] Microsoft Windows operating systems utilizing the AppX Deployment Service (AppXSVC), including Windows 10 and Windows Server 2016/2019
[Impact] An attacker with local user access can exploit the vulnerability to run arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Apply the official cumulative security updates provided by Microsoft and restrict local user privileges
Microsoft Windows splwow64 Local Privilege Escalation Vulnerability (CVE-2019-0880) Technical Advisory
[Affected Scope] splwow64.exe process running on 64-bit versions of Microsoft Windows operating systems
[Impact] Local attackers with low privileges can execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Apply the official Microsoft security patches immediately, or disable the Print Spooler service on non-essential servers
Microsoft Windows Task Scheduler Elevation of Privilege Vulnerability (CVE-2019-1069) Technical Advisory
[Affected Scope] Microsoft Windows operating systems including Windows 10 and Windows Server 2016/2019 with active Task Scheduler services
[Impact] Local authenticated attackers can bypass file operation validations via hard links to execute arbitrary code with SYSTEM privileges
[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict write permissions on Task Scheduler directories
Windows AppX Deployment Service (AppXSVC) Hard Link Elevation of Privilege Vulnerability (CVE-2019-1064)
[Affected Scope] Microsoft Windows operating systems, including Windows 10 and Windows Server 2016/2019, utilizing the AppX Deployment Service (AppXSVC)
[Impact] Local authenticated attackers can execute specially crafted applications to run arbitrary processes in an elevated SYSTEM context, leading to full system compromise
[Mitigation] Apply the official cumulative security updates provided by Microsoft and restrict local interactive logon privileges for unauthorized users
Windows GDI+ Memory Corruption Remote Code Execution Vulnerability (CVE-2019-0903) Security Advisory
[Affected Scope] Microsoft Windows operating systems and applications utilizing the Windows Graphics Device Interface (GDI+) library
[Impact] Successful exploitation allows remote attackers to execute arbitrary code and gain full system control via specially crafted media files
[Mitigation] Apply the official Microsoft security updates immediately and restrict the execution of untrusted media files
Windows Error Reporting (WER) Elevation of Privilege Vulnerability (CVE-2019-0863) Technical Analysis and Mitigation Guide
[Affected Scope] Multiple versions of Windows operating systems, including Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019
[Impact] A local attacker with low privileges can exploit the file handling mechanism of Windows Error Reporting (WER) to execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Immediately apply the official Microsoft security patches, and monitor for unauthorized symbolic link creation or anomalous file writes in the WER directories