CVE-2019-12177

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges via DLL hijacking.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.viveport.com/Vendor Advisory
https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8Exploit, Third Party Advisory
https://posts.specterops.io/razer-synapse-3-elevation-of-privilege-6d2802bd0585Not Applicable
https://community.viveport.com/Vendor Advisory
https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8Exploit, Third Party Advisory
https://posts.specterops.io/razer-synapse-3-elevation-of-privilege-6d2802bd0585Not Applicable

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-12185.4A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attac CVE-2019-121807.8An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Scrip CVE-2019-121818.8A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.CVE-2019-121829.8Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the admi CVE-2019-121837.5Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.CVE-2019-121845.4There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart,CVE-2019-121858.8eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote com CVE-2019-121864.8An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x th CVE-2019-121896.1An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.CVE-2019-12195.5An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Trans CVE-2019-121905.4XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or fi CVE-2019-121939.8H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.