DriveLock vulnerabilities
We track 9 vulnerabilities in DriveLock products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on July 29, 2026.
Latest DriveLock vulnerabilities
- 7.5 High severity
DriveLock: Improper Limitation of a Pathname to a Restricted Directory
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific
- 8.8 High severity
DriveLock: Improper Neutralization of Special Elements used in an SQL Command
DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the
- 7.5 High severity
DriveLock: Improper Limitation of a Pathname to a Restricted Directory
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific
- 9.8 Critical severity
Drivelock: Improper Authentication
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (D
- 9.8 Critical severity
Drivelock: Improper Privilege Management
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege
- 7.8 High severity
Drivelock: Improper Privilege Management
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers.
- 7.5 High severity
Drivelock: Improper Null Termination
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.
- 9.6 Critical severity
Drivelock: Improper Neutralization of Input During Web Page Generation
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
- 9.9 Critical severity
Drivelock: Improper Privilege Management
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.