deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23811
Published: 2024-02-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://cert-portal.siemens.com/productcert/html/ssa-943925.html; https://cert-portal.siemens.com/productcert/html/ssa-943925.html
CVE: CVE-2024-23812
Published: 2024-02-13
Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://cert-portal.siemens.com/productcert/html/ssa-943925.html; https://cert-portal.siemens.com/productcert/html/ssa-943925.html
CVE: CVE-2024-23813
Published: 2024-02-13
Description: A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://cert-portal.siemens.com/productcert/html/ssa-871717.html; https://cert-portal.siemens.com/productcert/html/ssa-871717.html
CVE: CVE-2024-23816
Published: 2024-02-13
Description: A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert-portal.siemens.com/productcert/html/ssa-580228.html; https://cert-portal.siemens.com/productcert/html/ssa-580228.html
CVE: CVE-2024-24920
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21710)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2024-24921
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application is vulnerable to memory corruption while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21712)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2024-24922
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21715)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2024-24923
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000), Simcenter Femap (All versions < V2306.0001). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22055)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2024-24924
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22059)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2024-24925
Published: 2024-02-13
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-22060)
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://cert-portal.siemens.com/productcert/html/ssa-000072.html; https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE: CVE-2023-6072
Published: 2024-02-13
Description: 
A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html; https://docs.trellix.com/bundle/cm_9-1-5_rn/page/UUID-fad8a50f-6f6f-e970-f418-06494a30932e.html
CVE: CVE-2024-1157
Published: 2024-02-13
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements/bt_bb_button/bt_bb_button.php#L161; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e166a7db-45f7-4a0d-9966-dbec9ade204a?source=cve
CVE: CVE-2024-1159
Published: 2024-02-13
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e71386ea-0546-4aa7-b77a-e1824e80accc?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=
CVE: CVE-2024-1160
Published: 2024-02-13
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30442 is likely a duplicate of this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/818d3418-8e14-49b9-a112-8eab9eb3c283?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=
CVE: CVE-2023-4408
Published: 2024-02-13
Description: The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.
This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: http://www.openwall.com/lists/oss-security/2024/02/13/1; https://kb.isc.org/docs/cve-2023-4408; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
CVE: CVE-2023-5517
Published: 2024-02-13
Description: A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:

  - `nxdomain-redirect <domain>;` is configured, and
  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.
This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: http://www.openwall.com/lists/oss-security/2024/02/13/1; https://kb.isc.org/docs/cve-2023-5517; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
CVE: CVE-2023-5679
Published: 2024-02-13
Description: A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.
This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: http://www.openwall.com/lists/oss-security/2024/02/13/1; https://kb.isc.org/docs/cve-2023-5679; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
CVE: CVE-2023-5680
Published: 2024-02-13
Description: If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. 
This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
CVSS Score: 5.3 (MEDIUM)
References: https://kb.isc.org/docs/cve-2023-5680; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://kb.isc.org/docs/cve-2023-5680
CVE: CVE-2023-6516
Published: 2024-02-13
Description: To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, `named` may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured `max-cache-size` limit to be significantly exceeded.
This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-789
References: http://www.openwall.com/lists/oss-security/2024/02/13/1; https://kb.isc.org/docs/cve-2023-6516; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
CVE: CVE-2024-0707
Published: 2024-02-13
Description: Rejected reason: **REJECT** Not a valid vulnerability.
CVE: CVE-2024-1309
Published: 2024-02-13
Description: Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://process.honeywell.com; https://www.honeywell.com/us/en/product-security; https://www.kb.cert.org/vuls/id/417980
CVE: CVE-2024-24781
Published: 2024-02-13
Description: An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port. 
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert.vde.com/en/advisories/VDE-2024-013; https://cert.vde.com/en/advisories/VDE-2024-013
CVE: CVE-2024-24782
Published: 2024-02-13
Description: An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://cert.vde.com/en/advisories/VDE-2024-013; https://cert.vde.com/en/advisories/VDE-2024-013
CVE: CVE-2024-1096
Published: 2024-02-13
Description: Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, 0x8011207C and 0x80112080 IOCTL codes of the fildds.sys driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.filseclab.com/en-us/products/twister.htm; https://fluidattacks.com/advisories/holiday/; http://www.filseclab.com/en-us/products/twister.htm
CVE: CVE-2024-1140
Published: 2024-02-13
Description: Twister Antivirus v8.17 is vulnerable to an Out-of-bounds Read vulnerability by triggering the 0x801120B8 IOCTL code of the filmfd.sys driver.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125
References: http://www.filseclab.com/en-us/products/twister.htm; https://fluidattacks.com/advisories/fitzgerald/; http://www.filseclab.com/en-us/products/twister.htm
CVE: CVE-2024-1163
Published: 2024-02-13
Description: The attacker may exploit a path traversal vulnerability leading to information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/mbloch/mapshaper/commit/7437d903c0a87802c3751fc529d2de7098094c72; https://huntr.com/bounties/c1cbc18b-e4ab-4332-ad13-0033f0f976f5; https://github.com/mbloch/mapshaper/commit/7437d903c0a87802c3751fc529d2de7098094c72
CVE: CVE-2024-23439
Published: 2024-02-13
Description: Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability by triggering the 0x22201B, 0x22201F, 0x222023, 0x222027 ,0x22202B, 0x22202F, 0x22203F, 0x222057 and 0x22205B IOCTL codes of the Vba32m64.sys driver.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://fluidattacks.com/advisories/adderley/; https://www.anti-virus.by/vba32; https://fluidattacks.com/advisories/adderley/
CVE: CVE-2024-23440
Published: 2024-02-13
Description: Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows to read up to 0x802 of memory from ar arbitrary user-supplied pointer.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://fluidattacks.com/advisories/adderley/; https://www.anti-virus.by/vba32; https://fluidattacks.com/advisories/adderley/
CVE: CVE-2023-26562
Published: 2024-02-13
Description: In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2023-45206
Published: 2024-02-13
Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2023-45207
Published: 2024-02-13
Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2023-48432
Published: 2024-02-13
Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2024-22923
Published: 2024-02-13
Description: SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://advradius.com/demo/; https://gist.github.com/whiteman007/; http://advradius.com/demo/
CVE: CVE-2023-20570
Published: 2024-02-13
Description: Insufficient verification of data authenticity in
the configuration state machine may allow a local attacker to potentially load
arbitrary bitstreams.






CVSS Score: 3.3 (LOW)
CWE: CWE-345, CWE-345
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8002.html; https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8002.html
CVE: CVE-2023-50808
Published: 2024-02-13
Description: Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P38; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2024-20667
Published: 2024-02-13
Description: Azure DevOps Server Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667
CVE: CVE-2024-20673
Published: 2024-02-13
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20673; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20673
CVE: CVE-2024-20679
Published: 2024-02-13
Description: Azure Stack Hub Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20679
CVE: CVE-2024-20684
Published: 2024-02-13
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20684; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20684
CVE: CVE-2024-20695
Published: 2024-02-13
Description: Skype for Business Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20695; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20695
CVE: CVE-2024-21304
Published: 2024-02-13
Description: Trusted Compute Base Elevation of Privilege Vulnerability
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21304; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21304
CVE: CVE-2024-21315
Published: 2024-02-13
Description: Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21315; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21315
CVE: CVE-2024-21327
Published: 2024-02-13
Description: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21327; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21327
CVE: CVE-2024-21328
Published: 2024-02-13
Description: Dynamics 365 Sales Spoofing Vulnerability
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21328; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21328
CVE: CVE-2024-21329
Published: 2024-02-13
Description: Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21329; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21329
CVE: CVE-2024-21338
Published: 2024-02-13
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338; https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
CVE: CVE-2024-21339
Published: 2024-02-13
Description: Windows USB Generic Parent Driver Remote Code Execution Vulnerability
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21339; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21339
CVE: CVE-2024-21340
Published: 2024-02-13
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21340; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21340