rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-28255 Authentication Bypass in OpenMetadata
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: open-metadata
product: OpenMetadata
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-03-15T19:55:45.090Z
CVE-2024-28265 
IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-28269 
ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malicious files. This could result in a Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2024-28270 
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-28275 
Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. This vulnerability allows attackers to intercept and access sensitive information, including users' credentials and password change requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-03T00:00:00.000Z
CVE-2024-28276 
Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:57:05.257Z
CVE-2024-28277 
In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling Stored Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript payloads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:51:05.163Z
CVE-2024-28279 
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:54:12.353Z
CVE-2024-28283 
There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28285 
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:07:16.320Z
CVE-2024-28286 
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_file_service.c. The vulnerability manifests as SEGV and causes the application to crash
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-28287 
A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-28288 
Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-30T00:00:00.000Z
CVE-2024-28294 
Limbas up to v5.2.14 was discovered to contain a SQL injection vulnerability via the ftid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-28297 
SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-28298 
SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, DOS_IDF, and possibly other parameters to /BMServerR.dll/BMRest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-28303 
Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28318 
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28319 
gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28320 
Insecure Direct Object References (IDOR) vulnerability in Hospital Management System 1.0 allows attackers to manipulate user parameters for unauthorized access and modifications via crafted POST request to /patient/edit-user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-28322 
SQL Injection vulnerability in /event-management-master/backend/register.php in PuneethReddyHC Event Management 1.0 allows attackers to run arbitrary SQL commands via the event_id parameter in a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-28323 
The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28325 
Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-28326 
Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-28327 
Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-28328 
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-28335 
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2024-28338 
A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2024-28339 
An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2024-28340 
An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-12T00:00:00.000Z
CVE-2024-28344 
An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to control the "back" parameter in the URL through a double encoded URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-28345 
An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visit the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-28353 
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28354 
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28383 
Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28386 
An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28387 
An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28388 
SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28389 
SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28390 
An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28391 
SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28392 
SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabandonmentproFrontCAPUnsubscribeJobModuleFrontController::setEmailVisualized() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-28393 
SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28394 
An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28395 
SQL injection vulnerability in Best-Kit bestkit_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit_popup.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-28396 
An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-28397 
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-20T00:00:00.000Z
CVE-2024-28401 
TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28402 
TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-21T00:00:00.000Z
CVE-2024-28403 
TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28404 
TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-15T00:00:00.000Z
CVE-2024-28405 
SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2024-28417 
Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28418 
Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28421 
SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the channelmodle.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28423 
Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28424 
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28425 
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-28429 
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-13T00:00:00.000Z
CVE-2024-28430 
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-13T00:00:00.000Z
CVE-2024-28431 
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-13T00:00:00.000Z
CVE-2024-28432 
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-13T00:00:00.000Z
CVE-2024-28434 
The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28435 
The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-28436 
Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DAP-3520, DAP-3662 allows a remote attacker to execute arbitrary code via the reload parameter in the session_login.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-28441 
File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-28442 
Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2024-28446 
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan_netmask parameter at /apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28447 
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan_ipaddr parameters at /apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-19T00:00:00.000Z
CVE-2024-28456 
Cross Site Scripting vulnerability in Campcodes Online Marriage Registration System v.1.0 allows a remote attacker to execute arbitrary code via the text fields in the marriage registration request form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-28T00:00:00.000Z
CVE-2024-28458 
Null Pointer Dereference vulnerability in swfdump in swftools 0.9.2 allows attackers to crash the appliation via the function compileSWFActionCode in action/actioncompiler.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-11T00:00:00.000Z
CVE-2024-28515 
Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-update.pl component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-03T00:00:00.000Z
CVE-2024-28519 
A kernel handle leak issue in ProcObsrvesx.sys 4.0.0.49 in MicroWorld Technologies Inc eScan Antivirus could allow privilege escalation for low-privileged users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-03T00:00:00.000Z