PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Microsoft Intune, Version 1.55.48.0 Advisory

bishopfox.com | blog | #microsoft | #privilege-escalation | #vulnerability | #security-advisory | #intune | #unquoted-search-path
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Advisory on Microsoft Intune 1.55.48.0: its Management Extension calls agentexecutor.exe unquoted, letting local users with write access run code as others; no fix is available.
Published
Collected

Related coverage

vulnerability · bishopfox.com
Windows Task Scheduler Application, Version 19044.1706 Advisory
Advisory on CVE-2023-21541: Windows Task Scheduler mis-quotes executable paths with environment variables, letting local attackers escalate privileges via a planted C:\Program.exe; patched in 2023.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
blog · bishopfox.com
Zilliz / Attu | 2.6.5
Bishop Fox disclosed two flaws in Zilliz Attu 2.6.5, the Milvus management UI. An unauthenticated SSRF combined with a regex validation bypass chains into Kubernetes namespace takeover, exposing entire clusters to attackers.
blog · bishopfox.com
Traeger Grill D2 Wi-Fi Controller, Version 2.02.04
Bishop Fox found two vulnerabilities and two informational issues in the Traeger Grill D2 Wi-Fi Controller (2.02.04), including authorization flaws (CVSS 7.1) enabling control of others' grills.
Back