deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-7221
Published: 2024-01-09
Description: A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/T6/1/README.md; https://vuldb.com/?ctiid.249855; https://vuldb.com/?id.249855
CVE: CVE-2024-0206
Published: 2024-01-09
Description: 
A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn't normally have permission to. After a scan, the Engine would follow the links and remove the files


CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10415; https://kcm.trellix.com/corporate/index?page=content&id=SB10415
CVE: CVE-2024-0213
Published: 2024-01-09
Description: 
A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly. 


CVSS Score: 8.2 (HIGH)
CWE: CWE-120, CWE-120
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10416; https://kcm.trellix.com/corporate/index?page=content&id=SB10416
CVE: CVE-2022-36763
Published: 2024-01-09
Description: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-119
References: https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/; https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr
CVE: CVE-2022-36764
Published: 2024-01-09
Description: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-119
References: https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/; https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j
CVE: CVE-2022-36765
Published: 2024-01-09
Description: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-680, CWE-119
References: https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/; https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx
CVE: CVE-2023-7222
Published: 2024-01-09
Description: A vulnerability was found in Totolink X2000R 1.0.0-B20[PII_REDACTED]. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120, CWE-787
References: https://github.com/jylsec/vuldb/blob/main/TOTOLINK/X2000R/formTmultiAP/README.md; https://vuldb.com/?ctiid.249856; https://vuldb.com/?id.249856
CVE: CVE-2023-7223
Published: 2024-01-09
Description: A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249867. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://drive.google.com/file/d/1puSOo5XrzMrctw7EtrE7DnfssOOuhRTS/view?usp=sharing; https://vuldb.com/?ctiid.249867; https://vuldb.com/?id.249867
CVE: CVE-2023-6129
Published: 2024-01-09
Description: Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on PowerPC CPU based platforms if the CPU provides vector instructions.

Impact summary: If an attacker can influence whether the POLY1305 MAC
algorithm is used, the application state might be corrupted with various
application dependent consequences.

The POLY1305 MAC (message authentication code) implementation in OpenSSL for
PowerPC CPUs restores the contents of vector registers in a different order
than they are saved. Thus the contents of some of these vector registers
are corrupted when returning to the caller. The vulnerable code is used only
on newer PowerPC processors supporting the PowerISA 2.07 instructions.

The consequences of this kind of internal application state corruption can
be various - from no consequences, if the calling application does not
depend on the contents of non-volatile XMM registers at all, to the worst
consequences, where the attacker could get complete control of the application
process. However unless the compiler uses the vector registers for storing
pointers, the most likely consequence, if any, would be an incorrect result
of some application dependent calculations or a crash leading to a denial of
service.

The POLY1305 MAC algorithm is most frequently used as part of the
CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
algorithm. The most common usage of this AEAD cipher is with TLS protocol
versions 1.2 and 1.3. If this cipher is enabled on the server a malicious
client can influence whether this AEAD cipher is used. This implies that
TLS server applications using OpenSSL can be potentially impacted. However
we are currently not aware of any concrete application that would be affected
by this issue therefore we consider this a Low severity security issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-440, CWE-787
References: https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35; https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04; https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015
CVE: CVE-2024-0228
Published: 2024-01-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is a duplicate of CVE-2024-0193.
CVE: CVE-2024-22164
Published: 2024-01-09
Description: In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770, CWE-400
References: https://advisory.splunk.com/advisories/SVD-2024-0101; https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/; https://advisory.splunk.com/advisories/SVD-2024-0101
CVE: CVE-2024-22165
Published: 2024-01-09
Description: In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.<br>The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2024-0102; https://research.splunk.com/application/7f6a07bd-82ef-46b8-8eba-802278abd00e/; https://advisory.splunk.com/advisories/SVD-2024-0102
CVE: CVE-2022-48618
Published: 2024-01-09
Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213535
CVE: CVE-2024-0056
Published: 2024-01-09
Description: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
CVSS Score: 8.7 (HIGH)
CWE: CWE-319
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056
CVE: CVE-2024-0057
Published: 2024-01-09
Description: NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-0226
Published: 2024-01-09
Description: Synopsys Seeker versions prior to 2023.12.0 are vulnerable to a stored cross-site scripting vulnerability through a specially crafted payload.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2024-0226-Affecting-Seeker; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2024-0226-Affecting-Seeker
CVE: CVE-2024-0340
Published: 2024-01-09
Description: A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2024:3618; https://access.redhat.com/errata/RHSA-2024:3627; https://access.redhat.com/errata/RHSA-2024:9315
CVE: CVE-2024-20652
Published: 2024-01-09
Description: Windows HTML Platforms Security Feature Bypass Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20652; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20652
CVE: CVE-2024-20653
Published: 2024-01-09
Description: Microsoft Common Log File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20653; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20653
CVE: CVE-2024-20654
Published: 2024-01-09
Description: Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20654; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20654
CVE: CVE-2024-20655
Published: 2024-01-09
Description: Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20655; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20655
CVE: CVE-2024-20656
Published: 2024-01-09
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20656; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20656
CVE: CVE-2024-20657
Published: 2024-01-09
Description: Windows Group Policy Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20657; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20657
CVE: CVE-2024-20658
Published: 2024-01-09
Description: Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20658; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20658
CVE: CVE-2024-20660
Published: 2024-01-09
Description: Microsoft Message Queuing Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20660; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20660
CVE: CVE-2024-20661
Published: 2024-01-09
Description: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20661; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20661
CVE: CVE-2024-20662
Published: 2024-01-09
Description: Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20662; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20662
CVE: CVE-2024-20663
Published: 2024-01-09
Description: Windows Message Queuing Client (MSMQC) Information Disclosure
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20663; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20663
CVE: CVE-2024-20664
Published: 2024-01-09
Description: Microsoft Message Queuing Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20664; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20664
CVE: CVE-2024-20666
Published: 2024-01-09
Description: BitLocker Security Feature Bypass Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20666; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20666
CVE: CVE-2024-20672
Published: 2024-01-09
Description: .NET Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20672; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20672; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-20674
Published: 2024-01-09
Description: Windows Kerberos Security Feature Bypass Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-305, CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674
CVE: CVE-2024-20676
Published: 2024-01-09
Description: Azure Storage Mover Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20676; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20676
CVE: CVE-2024-20677
Published: 2024-01-09
Description: A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365. As of February 13, 2024, the ability to insert FBX files has also been disabled in 3D Viewer.
3D models in Office documents that were previously inserted from a FBX file will continue to work as expected unless the Link to File option was chosen at insert time.
This change is effective as of the January 9, 2024 security update.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20677
CVE: CVE-2024-20680
Published: 2024-01-09
Description: Windows Message Queuing Client (MSMQC) Information Disclosure
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20680; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20680
CVE: CVE-2024-20681
Published: 2024-01-09
Description: Windows Subsystem for Linux Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20681; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20681
CVE: CVE-2024-20682
Published: 2024-01-09
Description: Windows Cryptographic Services Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20682; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20682
CVE: CVE-2024-20683
Published: 2024-01-09
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20683; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20683
CVE: CVE-2024-20686
Published: 2024-01-09
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20686; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20686
CVE: CVE-2024-20687
Published: 2024-01-09
Description: Microsoft AllJoyn API Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20687; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20687
CVE: CVE-2024-20690
Published: 2024-01-09
Description: Windows Nearby Sharing Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20690; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20690
CVE: CVE-2024-20691
Published: 2024-01-09
Description: Windows Themes Information Disclosure Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20691; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20691
CVE: CVE-2024-20692
Published: 2024-01-09
Description: Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-326, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20692; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20692
CVE: CVE-2024-20694
Published: 2024-01-09
Description: Windows CoreMessaging Information Disclosure  Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20694; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20694
CVE: CVE-2024-20696
Published: 2024-01-09
Description: Windows libarchive Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20696; https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/; https://github.com/clearbluejar/CVE-2024-20696
CVE: CVE-2024-20697
Published: 2024-01-09
Description: Windows libarchive Remote Code Execution Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20697; http://www.openwall.com/lists/oss-security/2024/06/04/2; http://www.openwall.com/lists/oss-security/2024/06/05/1
CVE: CVE-2024-20698
Published: 2024-01-09
Description: Windows Kernel Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698
CVE: CVE-2024-20699
Published: 2024-01-09
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20699; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20699
CVE: CVE-2024-20700
Published: 2024-01-09
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20700; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20700
CVE: CVE-2024-21305
Published: 2024-01-09
Description: Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-732
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21305; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21305
CVE: CVE-2024-21306
Published: 2024-01-09
Description: Microsoft Bluetooth Driver Spoofing Vulnerability
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-306
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21306; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21306
CVE: CVE-2024-21307
Published: 2024-01-09
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21307; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21307
CVE: CVE-2024-21309
Published: 2024-01-09
Description: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21309; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21309
CVE: CVE-2024-21310
Published: 2024-01-09
Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-197
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21310; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21310
CVE: CVE-2024-21311
Published: 2024-01-09
Description: Windows Cryptographic Services Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21311; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21311