Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ed to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com
le_groups`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h - https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60 - https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of
CVE ID: CVE-2024-29034 State: PUBLISHED Published: 2024-03-24T19:27:35.996Z Last Updated: 2024-08-02T01:03:51.518Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: carrierwaveuploader Products: carrierwave Problem Types: CWE-436, CWE-79 Description: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple valu
t is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw - https://github.com/carrierwaveuploader/carrierwave/commit/25b1c800d45ef8e78dc445ebe3bd8a6e3f0a3477
CVE ID: CVE-2024-29035 State: PUBLISHED Published: 2024-04-17T14:20:05.701Z Last Updated: 2024-08-02T01:03:51.734Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-918 Description: Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-74p6-39f2-23v3 - https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3
MS/security/advisories/GHSA-74p6-39f2-23v3 - https://github.com/umbraco/Umbraco-CMS/commit/6b8067815c02ae43161966a8075a3585e1bc4de0
CVE ID: CVE-2024-29036 State: PUBLISHED Published: 2024-03-20T20:39:01.341Z Last Updated: 2024-08-02T01:03:51.616Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: saleor Products: storefront Problem Types: CWE-200 Description: Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is
that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4 - https://github.com/saleor/saleor-docs/pull/1120 - https://github.com/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9da - https://github.com/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783
CVE ID: CVE-2024-29037 State: PUBLISHED Published: 2024-03-20T20:42:19.398Z Last Updated: 2024-08-02T14:24:02.094Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: acryldata Products: datahub-helm Problem Types: CWE-1394 Description: datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value,
cess tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to
ld default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/acryldata/datahub-helm/security/advisories/GHS
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/acryldata/datahub-helm/security/advisories/GHSA-82p6-9h7m-9h8j - https://github.com/acryldata/datahub-helm/commit/ea8a17860f053c63387b8309e1f77c0e1462a1b3
CVE ID: CVE-2024-29038 State: PUBLISHED Published: 2024-06-28T13:44:07.035Z Last Updated: 2025-11-04T17:19:44.720Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: tpm2-software Products: tpm2-tools Problem Types: CWE-1283, CWE-1390 Description: tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f - https://github.com/tpm2
erences: - https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f - https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
CVE ID: CVE-2024-29039 State: PUBLISHED Published: 2024-06-28T15:48:25.623Z Last Updated: 2025-11-04T17:19:47.529Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: tpm2-software Products: tpm2-tools Problem Types: CWE-807 Description: tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ture of the TPM state. This issue has been patched in version 5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6 - https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
CVE ID: CVE-2024-29040 State: PUBLISHED Published: 2024-06-28T21:02:04.076Z Last Updated: 2025-11-04T17:19:50.283Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: tpm2-software Products: tpm2-tss Problem Types: CWE-502 Description: This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the
he JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6 - https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0
CVE ID: CVE-2024-29041 State: PUBLISHED Published: 2024-03-25T20:20:06.205Z Last Updated: 2024-08-02T01:03:51.705Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: expressjs Products: express Problem Types: CWE-601, CWE-1286 Description: Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can
encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc - https://github.com/koajs/koa/issues/1800 - https://gi
ub.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc - https://github.com/koajs/koa/issues/1800 - https://github.com/expressjs/express/pull/5539 - https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd - https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94 - https://expressjs.com/en/4x/api.html#res.location
CVE ID: CVE-2024-29042 State: PUBLISHED Published: 2024-03-22T16:46:21.456Z Last Updated: 2024-08-02T01:03:51.704Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: franciscop Products: translate Problem Types: CWE-20 Description: Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the c
nt users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/franciscop/translate/security/advisories/GHSA-882j-4vj5-7vmj - https://github.com/franciscop/translate/commit/7a2bf8b9f05f7c45c09683973ef4d8e995804aa4 - https://github.com/franciscop/translate/commit/cc1ba03078102f83e0503a96f1a081489bb865d3
CVE ID: CVE-2024-29043 State: PUBLISHED Published: 2024-04-09T17:00:30.944Z Last Updated: 2025-05-03T00:39:31.870Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2022 for (CU 12), Microsoft SQL Server 2019 (CU 25), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (GDR), Microsoft ODBC Driver 17 for SQL Server on Windows, Microsoft ODBC Driver 17 for SQL Server on Linux, Microsoft ODBC Driver 17 for SQL Server on MacOS, Microsoft ODBC Driver 18 for SQL Server on Windows, Microsoft ODBC Driver 18 for SQL Server on Linux, Microsoft ODBC Driver 18 for SQL Server on MacOS Problem Types: CWE-416 Descr
ft ODBC Driver 18 for SQL Server on Linux, Microsoft ODBC Driver 18 for SQL Server on MacOS Problem Types: CWE-416 Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29043
CVE ID: CVE-2024-29044 State: PUBLISHED Published: 2024-04-09T17:01:18.882Z Last Updated: 2025-05-03T00:40:20.538Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 25), Microsoft SQL Server 2022 for (CU 12), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (GDR), Microsoft OLE DB Driver 19 for SQL Server, Microsoft OLE DB Driver 18 for SQL Server Problem Types: CWE-122 Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulne
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29044
CVE ID: CVE-2024-29045 State: PUBLISHED Published: 2024-04-09T17:00:31.478Z Last Updated: 2025-05-03T00:39:32.355Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 25), Microsoft SQL Server 2022 for (CU 12), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (GDR), Microsoft OLE DB Driver 19 for SQL Server, Microsoft OLE DB Driver 18 for SQL Server Problem Types: CWE-121 Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulne
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29045
CVE ID: CVE-2024-29046 State: PUBLISHED Published: 2024-04-09T17:01:19.418Z Last Updated: 2025-05-03T00:40:20.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (GDR), Microsoft OLE DB Driver 19 for SQL Server, Microsoft OLE DB Driver 18 for SQL Server, Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for (CU 12), Microsoft SQL Server 2019 (CU 25) Problem Types: CWE-122 Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulne
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29046
CVE ID: CVE-2024-29047 State: PUBLISHED Published: 2024-04-09T17:00:32.000Z Last Updated: 2025-05-03T00:39:32.924Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 25), Microsoft SQL Server 2022 for (CU 12) Problem Types: CWE-122 Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29047
CVE ID: CVE-2024-29048 State: PUBLISHED Published: 2024-04-09T17:01:19.942Z Last Updated: 2025-05-03T00:40:21.490Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 25), Microsoft SQL Server 2022 for (CU 12), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (GDR), Microsoft OLE DB Driver 19 for SQL Server, Microsoft OLE DB Driver 18 for SQL Server Problem Types: CWE-122 Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulne
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29048
CVE ID: CVE-2024-29049 State: PUBLISHED Published: 2024-04-04T21:47:08.397Z Last Updated: 2025-05-03T00:40:22.099Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Extended Stable, Microsoft Edge (Chromium-based) Problem Types: CWE-79 Description: Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29049
CVE ID: CVE-2024-29050 State: PUBLISHED Published: 2024-04-09T17:00:32.617Z Last Updated: 2025-05-03T00:39:33.442Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Servi
Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-197 Description: Windows Cryptographic Services Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/up
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29050
CVE ID: CVE-2024-29052 State: PUBLISHED Published: 2024-04-09T17:01:21.045Z Last Updated: 2025-08-27T15:50:30.619Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation) Problem Types: CWE-269 Description: Windows Storage Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-20
E Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29052
CVE ID: CVE-2024-29053 State: PUBLISHED Published: 2024-04-09T17:01:21.570Z Last Updated: 2025-05-03T00:40:23.281Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: CWE-36 Description: Microsoft Defender for IoT Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29053
CVE ID: CVE-2024-29054 State: PUBLISHED Published: 2024-04-09T17:01:22.657Z Last Updated: 2025-05-03T00:40:24.348Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: CWE-284 Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29054
CVE ID: CVE-2024-29055 State: PUBLISHED Published: 2024-04-09T17:01:22.100Z Last Updated: 2025-05-03T00:40:23.834Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Defender for IoT Problem Types: CWE-284 Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29055
CVE ID: CVE-2024-29056 State: PUBLISHED Published: 2024-04-09T17:01:23.210Z Last Updated: 2025-05-03T00:40:24.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows
ack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-327 Description: Windows Authentication Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29056
CVE ID: CVE-2024-29057 State: PUBLISHED Published: 2024-03-22T21:39:03.653Z Last Updated: 2025-05-03T00:47:12.976Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: CWE-357 Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29057