Vulnerabilities > Razer > Synapse > High

DATE CVE VULNERABILITY TITLE RISK
2023-09-14 CVE-2022-47631 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Razer Synapse
Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management.
local
high complexity
razer CWE-367
7.8
2022-03-23 CVE-2021-44226 Uncontrolled Search Path Element vulnerability in Razer Synapse
Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has been created by any unprivileged user before Synapse is installed.
local
low complexity
razer CWE-427
7.3
2017-09-13 CVE-2017-14398 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Razer Synapse 2.20.15.1104
rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection.
local
low complexity
razer CWE-119
7.8
2017-08-18 CVE-2017-11653 Incorrect Permission Assignment for Critical Resource vulnerability in Razer Synapse
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) RazerConfigNative.dll or (2) RazerConfigNativeLOC.dll file.
local
low complexity
razer CWE-732
7.8
2017-08-18 CVE-2017-11652 Incorrect Permission Assignment for Critical Resource vulnerability in Razer Synapse
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file.
local
low complexity
razer CWE-732
8.4