deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8943
Published: 2024-10-08
Description: The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including,  5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://wpdocs.latepoint.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bac8c35b-2afa-4347-b86e-2f16db19a4d3?source=cve
CVE: CVE-2024-3506
Published: 2024-10-08
Description: A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on Recording Server under strict conditions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://supportcommunity.milestonesys.com/KBRedir?art=000065801&lang=en_US
CVE: CVE-2024-8422
Published: 2024-10-08
Description: CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial
of service and loss of confidentiality & integrity when application user opens a malicious Zelio
Soft 2 project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-06.pdf
CVE: CVE-2024-8433
Published: 2024-10-08
Description: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/tags/1.1.0/views/admin/item_settings.php?rev=3156084#L196; https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/trunk/inc/megamenu-base.php#L35; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3163871%40themehunk-megamenu-plus&new=3163871%40themehunk-megamenu-plus&sfp_email=&sfph_mail=#file21
CVE: CVE-2024-8518
Published: 2024-10-08
Description: CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft
2 application when a specially crafted project file is loaded by an application user.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-06.pdf
CVE: CVE-2024-8629
Published: 2024-10-08
Description: The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.3.7/inc/class-wcml-comments.php#L257; https://plugins.trac.wordpress.org/changeset/3164233/woocommerce-multilingual/trunk/inc/class-wcml-comments.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/494dc869-6f4d-428b-99a8-87212f3007be?source=cve
CVE: CVE-2024-8488
Published: 2024-10-08
Description: The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3155029/survey-maker/tags/4.9.6/includes/class-survey-maker-data.php?old=3153722&old_path=survey-maker%2Ftags%2F4.9.5%2Fincludes%2Fclass-survey-maker-data.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e04edb6-ef37-4ea8-a734-dbdcf689ba9b?source=cve
CVE: CVE-2024-8884
Published: 2024-10-08
Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that
could cause exposure of credentials when attacker has access to application on network over
http
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-07&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-07.pdf
CVE: CVE-2024-9005
Published: 2024-10-08
Description: CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be
remotely executed on the server when unsafely deserialized data is posted to the web server.
CWE: CWE-502
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-05.pdf
CVE: CVE-2024-9207
Published: 2024-10-08
Description: The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/buddypress-docs/tags/2.2.3/includes/addon-history.php#L368; https://plugins.trac.wordpress.org/browser/buddypress-docs/tags/2.2.3/includes/templatetags.php#L282; https://plugins.trac.wordpress.org/changeset/3162780/#file32
CVE: CVE-2024-8431
Published: 2024-10-08
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.21/includes/extensions/block/src/init.php#L105; https://plugins.trac.wordpress.org/changeset/3162670/robo-gallery/trunk/includes/extensions/block/src/init.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=cve
CVE: CVE-2024-8482
Published: 2024-10-08
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.987/modules/team-member/widgets/wpr-team-member.php?rev=3162784; https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/team-member/widgets/wpr-team-member.php#L1746; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccece54-18fa-42e4-ba1a-d0879b73d66d?source=cve
CVE: CVE-2024-33506
Published: 2024-10-08
Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain (ADOM) to access device summary of unauthorized ADOMs via crafted HTTP requests.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-472
CVE: CVE-2024-45330
Published: 2024-10-08
Description: A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-196
CVE: CVE-2024-45880
Published: 2024-10-08
Description: A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system directly invokes the system function to execute commands for setting parameters such as MAC address without proper input filtering. This allows malicious users to inject and execute arbitrary commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/N1nEmAn/wp/blob/main/m0tOrol%40-Cx2l.pdf
CVE: CVE-2024-45230
Published: 2024-10-08
Description: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/sep/03/security-releases/
CVE: CVE-2024-45231
Published: 2024-10-08
Description: An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://www.djangoproject.com/weblog/2024/sep/03/security-releases/
CVE: CVE-2024-47161
Published: 2024-10-08
Description: In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-47948
Published: 2024-10-08
Description: In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-47949
Published: 2024-10-08
Description: In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-47950
Published: 2024-10-08
Description: In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-47951
Published: 2024-10-08
Description: In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-8215
Published: 2024-10-08
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, from 6.2022.1 before 6.2024.10, from 4.1.2.191.1 before 4.1.2.191.51.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2024.10.html; https://docs.payara.fish/enterprise/docs/5.68.0/Release%20Notes/Release%20Notes%205.68.0.html; https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.19.0.html
CVE: CVE-2024-3057
Published: 2024-10-08
Description: A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://support.purestorage.com/category/m_pure_storage_product_security
CVE: CVE-2024-44349
Published: 2024-10-08
Description: A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.cybergon.com/posts/cve-2024-44349/; https://cybergon.com/; https://github.com/AndreaF17/PoC-CVE-2024-44349
CVE: CVE-2024-45918
Published: 2024-10-08
Description: Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Y5neKO/3e29d32e07d90c96ae808d7e7839f0aa; https://www.kirisun.com/
CVE: CVE-2024-47007
Published: 2024-10-08
Description: A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE: CVE-2024-47008
Published: 2024-10-08
Description: Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE: CVE-2024-47009
Published: 2024-10-08
Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-288, CWE-22
References: https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE: CVE-2024-47010
Published: 2024-10-08
Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-288, CWE-22
References: https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE: CVE-2024-47011
Published: 2024-10-08
Description: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory
CVE: CVE-2024-7612
Published: 2024-10-08
Description: Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2024-7612
CVE: CVE-2024-8626
Published: 2024-10-08
Description: Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-401
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1706.html
CVE: CVE-2024-9124
Published: 2024-10-08
Description: A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 600T. If the device is overloaded with requests, it will become unavailable. The device may require a power cycle to recover it if it does not re-establish a connection after it stops receiving requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1705.html
CVE: CVE-2024-9167
Published: 2024-10-08
Description: Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://forums.ivanti.com/s/article/Security-Advisory-Velocity-License-Server-CVE-2024-9167
CVE: CVE-2024-9379
Published: 2024-10-08
Description: SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9379
CVE: CVE-2024-9380
Published: 2024-10-08
Description: An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9380
CVE: CVE-2024-9381
Published: 2024-10-08
Description: Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381
CVE: CVE-2024-9620
Published: 2024-10-08
Description: A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://access.redhat.com/security/cve/CVE-2024-9620; https://bugzilla.redhat.com/show_bug.cgi?id=2317129
CVE: CVE-2024-9621
Published: 2024-10-08
Description: A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the  application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://access.redhat.com/errata/RHSA-2024:10035; https://access.redhat.com/security/cve/CVE-2024-9621; https://bugzilla.redhat.com/show_bug.cgi?id=2317130
CVE: CVE-2024-9622
Published: 2024-10-08
Description: A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: https://access.redhat.com/security/cve/CVE-2024-9622; https://bugzilla.redhat.com/show_bug.cgi?id=2317179; https://github.com/orgs/resteasy/discussions/4351
CVE: CVE-2024-20659
Published: 2024-10-08
Description: Windows Hyper-V Security Feature Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20659
CVE: CVE-2024-25885
Published: 2024-10-08
Description: An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: http://dirk.com; http://xhtml2pdf.com; https://gist.github.com/salvatore-abello/c88dd[PII_REDACTED]023ef36c7b576d206
CVE: CVE-2024-30092
Published: 2024-10-08
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-829
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30092
CVE: CVE-2024-35215
Published: 2024-10-08
Description: NULL pointer dereference in IP socket options processing of the Networking Stack in QNX Software Development Platform (SDP) version(s) 7.1 and 7.0 could allow an attacker with local access to cause a denial-of-service condition in the context of the Networking Stack process.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://support.blackberry.com/pkb/s/article/140162
CVE: CVE-2024-37976
Published: 2024-10-08
Description: Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37976
CVE: CVE-2024-37979
Published: 2024-10-08
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37979
CVE: CVE-2024-37982
Published: 2024-10-08
Description: Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37982
CVE: CVE-2024-37983
Published: 2024-10-08
Description: Windows Resume Extensible Firmware Interface Security Feature Bypass Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37983
CVE: CVE-2024-38029
Published: 2024-10-08
Description: Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38029
CVE: CVE-2024-38097
Published: 2024-10-08
Description: Azure Monitor Agent Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38097
CVE: CVE-2024-38124
Published: 2024-10-08
Description: Windows Netlogon Elevation of Privilege Vulnerability
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38124
CVE: CVE-2024-38129
Published: 2024-10-08
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38129
CVE: CVE-2024-38149
Published: 2024-10-08
Description: BranchCache Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38149
CVE: CVE-2024-38179
Published: 2024-10-08
Description: Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38179