CVE Feed

    Dashboard / CVE / CVE-2015-0078

    CVE-2015-0078

    win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

    Published:Mar 11, 2015
    Last Modified:Apr 12, 2025
    EPS:Mar 11, 2015
    EPSS Score:0.04706
    CVSS Score:7.2

    Affected Products

    Vendor
    Microsoft
    Product
    Windows 8
    Vendor
    Microsoft
    Product
    Windows 8.1
    Vendor
    Microsoft
    Product
    Windows Rt
    Vendor
    Microsoft
    Product
    Windows Rt 8.1
    Vendor
    Microsoft
    Product
    Windows Server 2012

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2019-19161 (CVSS 7.2) — CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability i…
    CVE-2019-19160 (CVSS 5.7) — Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscri…
    CVE-2020-7808 (CVSS 8.7) — In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update modu…
    CVE-2019-19165 (CVSS 7.2) — AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be down…
    CVE-2020-7804 (CVSS 6.4) — ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute …
    CVE-2019-14678 (CVSS 10) — SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attacker…
    CVE-2018-16183 (CVSS 7.8) — An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32b…
    CVE-2018-16160 (CVSS 7.8) — SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in t…
    CVE-2017-14010 (CVSS 7.8) — In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled se…
    CVE-2018-6947 (CVSS 7.8) — An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shippe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High