CVE-2025-0120

HIGH Year: 2025
Weakness Type
CWE-250
View all →

Vulnerability Description

A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race condition, which makes this vulnerability difficult to exploit.

Related Vulnerabilities

CVE-2024-3330

CRITICAL
CVSS:9.9(Critical)

Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerabili...

CWE-2502024

CVE-2024-8767

CRITICAL
CVSS:9.9(Critical)

Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backu...

CWE-2502024

CVE-2025-32445

CRITICAL
CVSS:9.9(Critical)

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host syst...

CWE-2502025

CVE-2021-41035

CRITICAL
CVSS:9.8(Critical)

In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.

CWE-2502021

CVE-2022-1517

CRITICAL
CVSS:9.8(Critical)

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations,...

CWE-2502022

CVE-2022-2634

CRITICAL
CVSS:9.8(Critical)

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which...

CWE-2502022