| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Windows Kernel Elevation of Privilege Vulnerability |
| Windows WalletService Elevation of Privilege Vulnerability |
| Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability |
| Windows Event Tracing Elevation of Privilege Vulnerability |
| Windows CSC Service Elevation of Privilege Vulnerability |
| Windows Fax Compose Form Remote Code Execution Vulnerability |
| Windows CSC Service Elevation of Privilege Vulnerability |
| Windows CSC Service Elevation of Privilege Vulnerability |
| Windows CSC Service Elevation of Privilege Vulnerability |
| Windows CSC Service Elevation of Privilege Vulnerability |
| Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability |
| Windows Runtime C++ Template Library Elevation of Privilege Vulnerability |
| Active Template Library Elevation of Privilege Vulnerability |
| Microsoft splwow64 Elevation of Privilege Vulnerability |
| Windows WLAN Service Elevation of Privilege Vulnerability |
| Windows AppX Deployment Extensions Elevation of Privilege Vulnerability |
| Windows Print Spooler Elevation of Privilege Vulnerability |
| A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a command injection attack and elevate privileges to root. This vulnerability is due to insufficient input validation for specific API endpoints. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting and modifying specific internode communications from one ISE persona to another ISE persona. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying operating system. To exploit this vulnerability, the attacker would need to decrypt HTTPS traffic between two ISE personas that are located on separate nodes. |
| A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system. This vulnerability is due to an insufficient role-based access control (RBAC). An attacker with Administrator read-only credentials could exploit this vulnerability by sending a specific API request using an app with admin write credentials. A successful exploit could allow the attacker to elevate privileges to Administrator with write privileges on the affected device. |
| A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. To exploit this vulnerability, an attacker must have a valid account on an affected device. The vulnerability exists because the affected software incorrectly runs the SFTP user service at the privilege level of the account that was running when the ConfD built-in Secure Shell (SSH) server for CLI was enabled. If the ConfD built-in SSH server was not enabled, the device is not affected by this vulnerability. An attacker with low-level privileges could exploit this vulnerability by authenticating to an affected device and issuing a series of commands at the SFTP interface. A successful exploit could allow the attacker to elevate privileges to the level of the account under which ConfD is running, which is commonly root. Note: Any user who can authenticate to the built-in SSH server may exploit this vulnerability. By default, all ConfD users have this access if the server is enabled. Software updates that address this vulnerability have been released. |
