tl;dr: When you open a password protected zip archive using Windows Explorer (“Extract All…”), in Windows 8.x/10 the password is automatically cached in the Credentials Manager for the life of the logon session.

Read more here.

Cheers,
kyREcon

You can read advisory details here, and an exploitation write-up here.

Enjoy,
kyREcon

You can read the abstract and download the full white paper here.

Kudos to @OlgaAngel for dedicating some of her time to do some nice aesthetic improvements in the final version.

Enjoy,
kyREcon

• CVE-2015-8772
• CVE-2015-8773

Enjoy,
kyREcon

I have recently discovered a bug in Avast Windows products (not CVE-2015-2032) that allows a local attacker to elevate his privileges and execute code as SYSTEM.
The details will be published in the near future, but in the meantime…

Enjoy,
kyREcon