Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.6
CVSSv2

CVE-2021-28310

Published: 13/04/2021 Updated: 29/12/2023
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 410
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Windows 10

Vulnerability Summary

Win32k Elevation of Privilege Vulnerability

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows 10 1803

microsoft windows server 2019 -

microsoft windows 10 1809

microsoft windows server 2016 1909

microsoft windows 10 1909

microsoft windows 10 2004

microsoft windows server 2016 2004

microsoft windows 10 20h2

microsoft windows server 2016 20h2

Github Repositories

https://github.com/tongson/patch_tuesday

Demo standalone LadyLua program. Run after every second tuesday(US) of the month.

patch_tuesday Demo standalone Lua program by gopher-lua+LadyLua Building go build Example Output $ /patch_tuesday 2021-apr April 2021 Security Updates [+] Found 147 vulnerabilities Elevation of Privilege 19 Security Feature Bypass 5 Remote Code Execution 56 Information Disclosure 17 Denial of Service 9 Spoofing

https://github.com/jessica0f0116/DirectComposition-exp

CVE 2019 1065 This is a vulnerability in DirectComposition, which is a user-mode graphics component but is managed by win32kbase; so commands are sent to win32kbasesys through syscalls and then delegated to user-mode dwmexe through ALPC It's all c++ so resources are managed through refcounted objects/raii In fact there are a lot of reference counting bugs: reference co

Recent Articles

NSA helps out Microsoft with critical Exchange Server vulnerability disclosures in an April shower of patches
The Register • Thomas Claburn in San Francisco • 13 Apr 2021

100+ fixes for the Windows world – plus holes in SAP, Adobe, FreeBSD, etc SAP: It takes exploit devs about 72 hours to turn one of our security patches into a weapon against customers

Patch Tuesday April showers bring hours of patches as Microsoft delivers its Patch Tuesday fun-fest consisting of over a hundred CVEs, including four Exchange Server vulnerabilities reported to the company by the US National Security Agency (NSA). Forty-four different products and services are affected, mainly having to do with Azure, Exchange Server, Office, Visual Studio Code, and Windows. Among the vulnerabilities, four have been publicly disclosed and a fifth is being actively exploited. Nin...

Read more...

References

CWE-787https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28310https://nvd.nist.govhttps://github.com/tongson/patch_tuesdayhttps://www.theregister.co.uk/2021/04/13/patch_tuesday_april/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook