deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42784
Published: 2025-03-11
Description: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-228
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-115
CVE: CVE-2023-48790
Published: 2025-03-11
Description: A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-353
CVE: CVE-2024-32123
Published: 2025-03-11
Description: Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2
7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 and 5.6.0 through 5.6.11 and 5.4.0 through 5.4.7 and 5.2.0 through 5.2.10 and 5.0.0 through 5.0.12 and 4.3.4 through 4.3.8 allows attacker to execute unauthorized code or commands via crafted CLI requests.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-24-124
CVE: CVE-2024-33501
Published: 2025-03-11
Description: Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-89
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-130
CVE: CVE-2024-45324
Published: 2025-03-11
Description: A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-325
CVE: CVE-2024-45328
Published: 2025-03-11
Description: An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-261
CVE: CVE-2024-46663
Published: 2025-03-11
Description: A stack-buffer overflow vulnerability [CWE-121] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-331
CVE: CVE-2024-51319
Published: 2025-03-11
Description: A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp.
CVSS Score: 7.3 (HIGH)
CWE: CWE-98
References: https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE: CVE-2024-51320
Published: 2025-03-11
Description: Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsave_htmltmp, /servlet/gsdm_btlk_openfile components
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/; https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE: CVE-2024-51321
Published: 2025-03-11
Description: In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.
CVSS Score: 7.6 (HIGH)
CWE: CWE-601
References: https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE: CVE-2024-51322
Published: 2025-03-11
Description: Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmd_container.jsp components
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/; https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE: CVE-2024-52960
Published: 2025-03-11
Description: A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-602
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-305
CVE: CVE-2024-52961
Published: 2025-03-11
Description: An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-306
CVE: CVE-2024-54018
Published: 2025-03-11
Description: Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-110
CVE: CVE-2024-54026
Published: 2025-03-11
Description: An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox Cloud 24.1 allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-353
CVE: CVE-2024-55590
Published: 2025-03-11
Description: Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiIsolator version 2.4.0 through 2.4.5 allows an authenticated attacker with at least read-only admin permission and CLI access to execute unauthorized code via specifically crafted CLI commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-178
CVE: CVE-2024-55592
Published: 2025-03-11
Description: An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.
CVSS Score: 3.8 (LOW)
CWE: CWE-863
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-377
CVE: CVE-2024-55597
Published: 2025-03-11
Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-439
CVE: CVE-2025-22454
Published: 2025-03-11
Description: Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454
CVE: CVE-2025-27403
Published: 2025-03-11
Description: Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment, Ratify can be configured to authenticate to a private Azure Container Registry (ACR). The Azure workload identity and Azure managed identity authentication providers are configured in this setup. Users that configure a private ACR to be used with the Azure authentication providers may be impacted by a vulnerability that exists in versions prior to 1.2.3 and 1.3.2. Both Azure authentication providers attempt to exchange an Entra ID (EID) token for an ACR refresh token. However, Ratify’s Azure authentication providers did not verify that the target registry is an ACR. This could have led to the EID token being presented to a non-ACR registry during token exchange. EID tokens with ACR access can potentially be extracted and abused if a user workload contains an image reference to a malicious registry. As of versions 1.2.3 and 1.3.2, the Azure workload identity and Azure managed identity authentication providers are updated to add new validation prior to EID token exchange. Validation relies upon registry domain validation against a pre-configured list of well-known ACR endpoints. EID token exchange will be executed only if at least one of the configured well-known domain suffixes (wildcard support included) matches the registry domain of the image reference.
CWE: CWE-287
References: https://github.com/ratify-project/ratify/commit/0ec0c08490e3d672ae64b1a220c90d5484f1c93f; https://github.com/ratify-project/ratify/commit/84c7c48fa76bb9a1c9583635d1e90bc25b1a546c; https://github.com/ratify-project/ratify/security/advisories/GHSA-44f7-5fj5-h4px
CVE: CVE-2025-25680
Published: 2025-03-11
Description: LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerability allows arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera.
CVSS Score: 7.7 (HIGH)
CWE: CWE-94
References: https://github.com/Yasha-ops/LSC_Indoor_PTZ_Camera-RCE; https://github.com/Yasha-ops/vulnerability-research/tree/master/CVE-2025-25680
CVE: CVE-2025-25747
Published: 2025-03-11
Description: Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://www.huyvo.net/post/cve-2025-25747-reflected-xss-vulnerability-in-hoteldruid-3-0-7; https://www.huyvo.net/post/cve-2025-25747-reflected-xss-vulnerability-in-hoteldruid-3-0-7
CVE: CVE-2025-27601
Published: 2025-03-11
Description: Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd; https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x
CVE: CVE-2025-27602
Published: 2025-03-11
Description: Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7; https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698
CVE: CVE-2025-27617
Published: 2025-03-11
Description: Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47; https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347; https://github.com/pimcore/pimcore/commit/19a[PII_REDACTED]e68fd254773e32476565d91deea
CVE: CVE-2024-56338
Published: 2025-03-11
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7185265
CVE: CVE-2024-9157
Published: 2025-03-11
Description: ** UNSUPPORTED WHEN ASSIGNED ** 

A privilege escalation vulnerability in CxUIUSvc64.exe and
CxUIUSvc32.exe of Synaptics audio drivers allows a local authorized
attacker to load a DLL in a privileged process.


Out of an abundance of caution, this CVE ID is being
assigned to better serve our customers and ensure all who are still running
this product understand that the product is End-of-Life and should be removed.
For more information on this, refer to the CVE Record’s reference information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.synaptics.com/sites/default/files/2025-03/audio-driver-security-brief-2025-03-11.pdf
CVE: CVE-2025-0149
Published: 2025-03-11
Description: Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25008/
CVE: CVE-2025-21169
Published: 2025-03-11
Description: Substance3D - Designer versions 14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-22.html
CVE: CVE-2025-21180
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21180
CVE: CVE-2025-21199
Published: 2025-03-11
Description: Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21199
CVE: CVE-2025-21247
Published: 2025-03-11
Description: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-41
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21247
CVE: CVE-2025-22213
Published: 2025-03-11
Description: Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
CWE: CWE-434
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-malicious-file-uploads-via-media-managere-malicious-file-uploads-via-media-manager.html
CVE: CVE-2025-24035
Published: 2025-03-11
Description: Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035
CVE: CVE-2025-24043
Published: 2025-03-11
Description: Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24043
CVE: CVE-2025-24044
Published: 2025-03-11
Description: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24044
CVE: CVE-2025-24045
Published: 2025-03-11
Description: Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045
CVE: CVE-2025-24046
Published: 2025-03-11
Description: Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24046
CVE: CVE-2025-24048
Published: 2025-03-11
Description: Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24048
CVE: CVE-2025-24049
Published: 2025-03-11
Description: Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049
CVE: CVE-2025-24050
Published: 2025-03-11
Description: Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24050
CVE: CVE-2025-24051
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24051
CVE: CVE-2025-24054
Published: 2025-03-11
Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054; http://seclists.org/fulldisclosure/2025/Apr/28; https://www.exploit-db.com/exploits/52478
CVE: CVE-2025-24055
Published: 2025-03-11
Description: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24055
CVE: CVE-2025-24056
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24056
CVE: CVE-2025-24057
Published: 2025-03-11
Description: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24057
CVE: CVE-2025-24059
Published: 2025-03-11
Description: Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-681
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24059
CVE: CVE-2025-24061
Published: 2025-03-11
Description: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24061
CVE: CVE-2025-24064
Published: 2025-03-11
Description: Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24064
CVE: CVE-2025-24066
Published: 2025-03-11
Description: Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24066
CVE: CVE-2025-24067
Published: 2025-03-11
Description: Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24067
CVE: CVE-2025-24070
Published: 2025-03-11
Description: Weak authentication in ASP.NET Core &amp; Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1390
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070; https://www.herodevs.com/vulnerability-directory/cve-2025-24070
CVE: CVE-2025-24071
Published: 2025-03-11
Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071; https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-detection-scrip; https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-mitigation-script
CVE: CVE-2025-24072
Published: 2025-03-11
Description: Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24072