CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows Installer Elevation of Privilege Vulnerability (CVE-2024-38014) Security Advisory
[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions
[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code
[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users
Microsoft Windows Installer Elevation of Privilege Vulnerability (CVE-2021-41379) Technical Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems, including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022
[Impact] A local authenticated attacker can exploit improper link resolution in the Windows Installer service to delete or manipulate arbitrary files with SYSTEM privileges, potentially leading to full local privilege escalation
[Mitigation] Apply the official cumulative security updates provided by Microsoft immediately, or restrict Windows Installer execution for non-administrative users as a temporary workaround
Windows Installer Privilege Escalation via Symbolic Link Manipulation (CVE-2020-0683)
[Affected Scope] Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 containing the Windows Installer service
[Impact] Local attackers can exploit improper symbolic link handling in MSI packages to execute arbitrary code with SYSTEM privileges, leading to full host compromise
[Mitigation] Apply the official Microsoft security updates immediately and restrict non-admin MSI installation privileges as a temporary workaround