CVE-2019-1405
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability
CVSS
7.8
Alta
EPSS
30.2%
p98
KEV
SIM
15 de mar. de 2022
Exploit Today
79
0-100
Publicado: 12 de nov. de 2019 · Última mod.: 12 de ago. de 2026 · CWE-269
30.2%EPSS · 30 dias30.2%
2026-10-082026-11-05
Produto
Microsoft / Windows
Vulnerabilidade
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability
Adicionado ao KEV
15 de mar. de 2022
Corrigir até
5 de abr. de 2022
Uso conhecido em ransomware
Sim
Descrição resumida
A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.
Ação necessária
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2019-1405
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
- packetstormsecurity.comhttp://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html
- portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405
- packetstormsecurity.comhttp://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html
- portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1405
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1003638.8 ALT—
——0SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses ACLRoles, ACLActions, and Administration to carry attacker-controlled data or authorization state into the security-sensitive operation. A low-privileged user can create roles, change ACL levels, bind elevated roles, and alter global configuration to obtain administrator-equivalent control of CRM data and behavior. This issue is fixed in versions 7.15.2 and 8.10.2.7hCVE-2026-774398.8 ALT—
——0Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting themselves, an editor can take ownership of the album, remove the original owner, and delete the album. This vulnerability is fixed in version 3.0.3.8hCVE-2026-1181938.8 ALT34.1%
——10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.21hCVE-2026-1223139.9 CRÍ24.1%
——7Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.11hCVE-2026-1223127.7 ALT24.1%
——7Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.11hCVE-2026-1223029.8 CRÍ21.1%
——6Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.11h