stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-3808 (severity: HIGH, weakness: NVD-CWE-Other)
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38080 (severity: HIGH, weakness: CWE-190)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2024-38081 (severity: HIGH, weakness: CWE-59)
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2024-38082 (severity: MEDIUM, weakness: CWE-451)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38083 (severity: MEDIUM, weakness: CWE-449)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38084 (severity: HIGH, weakness: CWE-59)
Microsoft OfficePlus Elevation of Privilege Vulnerability
CVE-2024-38085 (severity: HIGH, weakness: CWE-416)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2024-38086 (severity: MEDIUM, weakness: CWE-197)
Azure Kinect SDK Remote Code Execution Vulnerability
CVE-2024-38087 (severity: HIGH, weakness: CWE-415)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-38088 (severity: HIGH, weakness: CWE-122)
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-38089 (severity: CRITICAL, weakness: CWE-269)
Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVE-2024-3809 (severity: HIGH, weakness: NVD-CWE-Other)
The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38091 (severity: HIGH, weakness: CWE-166)
Microsoft WS-Discovery Denial of Service Vulnerability
CVE-2024-38092 (severity: HIGH, weakness: CWE-693)
Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2024-38093 (severity: MEDIUM, weakness: CWE-451)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38094 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2024-38095 (severity: HIGH, weakness: CWE-20)
.NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38097 (severity: HIGH, weakness: CWE-59)
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-38098 (severity: HIGH, weakness: CWE-59)
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-38099 (severity: MEDIUM, weakness: CWE-287)
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-3810 (severity: HIGH, weakness: NVD-CWE-Other)
The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38100 (severity: HIGH, weakness: CWE-284)
Windows File Explorer Elevation of Privilege Vulnerability
CVE-2024-38101 (severity: MEDIUM, weakness: CWE-125)
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVE-2024-38102 (severity: MEDIUM, weakness: CWE-125)
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVE-2024-38103 (severity: MEDIUM, weakness: CWE-359)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-38104 (severity: HIGH, weakness: CWE-822)
Windows Fax Service Remote Code Execution Vulnerability
CVE-2024-38105 (severity: MEDIUM, weakness: CWE-20)
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVE-2024-38106 (severity: HIGH, weakness: CWE-591)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-38107 (severity: HIGH, weakness: CWE-416)
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
CVE-2024-38108 (severity: CRITICAL, weakness: CWE-79)
Azure Stack Hub Spoofing Vulnerability
CVE-2024-38109 (severity: HIGH, weakness: CWE-918)
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
CVE-2024-3811 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38112 (severity: HIGH, weakness: CWE-451)
Windows MSHTML Platform Spoofing Vulnerability
CVE-2024-38114 (severity: HIGH, weakness: CWE-122)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38115 (severity: HIGH, weakness: CWE-122)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38116 (severity: HIGH, weakness: CWE-122)
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38117 (severity: HIGH, weakness: CWE-125)
NTFS Elevation of Privilege Vulnerability
CVE-2024-38118 (severity: MEDIUM, weakness: CWE-908)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVE-2024-38119 (severity: HIGH, weakness: CWE-416)
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
CVE-2024-3812 (severity: HIGH, weakness: NVD-CWE-Other)
The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38120 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38121 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38122 (severity: MEDIUM, weakness: CWE-908)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVE-2024-38123 (severity: MEDIUM, weakness: CWE-125)
Windows Bluetooth Driver Information Disclosure Vulnerability
CVE-2024-38124 (severity: CRITICAL, weakness: CWE-287)
Windows Netlogon Elevation of Privilege Vulnerability
CVE-2024-38125 (severity: HIGH, weakness: CWE-197)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38126 (severity: HIGH, weakness: CWE-476)
Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-38127 (severity: HIGH, weakness: CWE-126)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2024-38128 (severity: HIGH, weakness: CWE-190)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38129 (severity: MEDIUM, weakness: CWE-285)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2024-3813 (severity: HIGH, weakness: NVD-CWE-Other)
The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38130 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38131 (severity: HIGH, weakness: CWE-591)
Clipboard Virtual Channel Extension Remote Code Execution Vulnerability
CVE-2024-38132 (severity: HIGH, weakness: CWE-125)
Windows Network Address Translation (NAT) Denial of Service Vulnerability
CVE-2024-38133 (severity: HIGH, weakness: CWE-138)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-38134 (severity: HIGH, weakness: CWE-125)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38135 (severity: HIGH, weakness: CWE-126)
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
CVE-2024-38136 (severity: HIGH, weakness: CWE-416)
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
CVE-2024-38137 (severity: HIGH, weakness: CWE-416)
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
CVE-2024-38138 (severity: HIGH, weakness: CWE-416)
Windows Deployment Services Remote Code Execution Vulnerability
CVE-2024-38139 (severity: HIGH, weakness: CWE-287)
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
CVE-2024-3814 (severity: MEDIUM, weakness: CWE-79)
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38140 (severity: CRITICAL, weakness: CWE-416)
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
CVE-2024-38141 (severity: HIGH, weakness: CWE-416)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2024-38142 (severity: HIGH, weakness: CWE-122)
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2024-38143 (severity: MEDIUM, weakness: CWE-306)
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
CVE-2024-38144 (severity: HIGH, weakness: CWE-190)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38145 (severity: HIGH, weakness: CWE-476)
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVE-2024-38146 (severity: HIGH, weakness: CWE-476)
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVE-2024-38147 (severity: HIGH, weakness: CWE-416)
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-38148 (severity: HIGH, weakness: CWE-125)
Windows Secure Channel Denial of Service Vulnerability
CVE-2024-38149 (severity: HIGH, weakness: CWE-400)
BranchCache Denial of Service Vulnerability
CVE-2024-3815 (severity: MEDIUM, weakness: CWE-79)
The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38150 (severity: HIGH, weakness: CWE-416)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-38151 (severity: MEDIUM, weakness: CWE-125)
Windows Kernel Information Disclosure Vulnerability
CVE-2024-38152 (severity: HIGH, weakness: CWE-122)
Windows OLE Remote Code Execution Vulnerability
CVE-2024-38153 (severity: HIGH, weakness: CWE-367)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-38154 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38155 (severity: MEDIUM, weakness: CWE-125)
Security Center Broker Information Disclosure Vulnerability
CVE-2024-38156 (severity: MEDIUM, weakness: CWE-79)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38157 (severity: HIGH, weakness: CWE-415)
Azure IoT SDK Remote Code Execution Vulnerability
CVE-2024-38158 (severity: HIGH, weakness: CWE-416)
Azure IoT SDK Remote Code Execution Vulnerability
CVE-2024-38159 (severity: CRITICAL, weakness: CWE-416)
Windows Network Virtualization Remote Code Execution Vulnerability
CVE-2024-3816 (severity: CRITICAL, weakness: CWE-89)
Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.
CVE-2024-38160 (severity: CRITICAL, weakness: CWE-122)
Windows Network Virtualization Remote Code Execution Vulnerability
CVE-2024-38161 (severity: MEDIUM, weakness: CWE-122)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-38162 (severity: HIGH, weakness: CWE-284)
Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2024-38163 (severity: HIGH, weakness: CWE-284)
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-38164 (severity: HIGH, weakness: CWE-284)
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.
CVE-2024-38165 (severity: MEDIUM, weakness: CWE-73)
Windows Compressed Folder Tampering Vulnerability
CVE-2024-38166 (severity: MEDIUM, weakness: CWE-79)
An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.
CVE-2024-38167 (severity: MEDIUM, weakness: CWE-319)
.NET and Visual Studio Information Disclosure Vulnerability
CVE-2024-38168 (severity: HIGH, weakness: CWE-400)
.NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38169 (severity: HIGH, weakness: CWE-122)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2024-3817 (severity: CRITICAL, weakness: CWE-88)
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
CVE-2024-38170 (severity: HIGH, weakness: CWE-122)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-38171 (severity: HIGH, weakness: CWE-416)
Microsoft PowerPoint Remote Code Execution Vulnerability
CVE-2024-38172 (severity: HIGH, weakness: CWE-122)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-38173 (severity: MEDIUM, weakness: CWE-73)
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38175 (severity: HIGH, weakness: CWE-284)
An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.
CVE-2024-38176 (severity: HIGH, weakness: CWE-307)
An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network.
CVE-2024-38177 (severity: HIGH, weakness: CWE-116)
Windows App Installer Spoofing Vulnerability
CVE-2024-38178 (severity: HIGH, weakness: CWE-843)
Scripting Engine Memory Corruption Vulnerability
CVE-2024-38179 (severity: HIGH, weakness: CWE-862)
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability
CVE-2024-3818 (severity: MEDIUM, weakness: CWE-79)
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Social Icons" block in all versions up to, and including, 4.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38180 (severity: HIGH, weakness: CWE-693)
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2024-38182 (severity: CRITICAL, weakness: CWE-1390)
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
CVE-2024-38183 (severity: CRITICAL, weakness: CWE-918)
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network.
CVE-2024-38184 (severity: HIGH, weakness: CWE-125)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-38185 (severity: HIGH, weakness: CWE-822)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-38186 (severity: HIGH, weakness: CWE-367)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-38187 (severity: HIGH, weakness: CWE-822)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-38188 (severity: HIGH, weakness: CWE-59)
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
CVE-2024-38189 (severity: HIGH, weakness: CWE-20)
Microsoft Project Remote Code Execution Vulnerability
CVE-2024-3819 (severity: MEDIUM, weakness: CWE-79)
The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-38190 (severity: HIGH, weakness: CWE-862)
Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector.
CVE-2024-38191 (severity: HIGH, weakness: CWE-362)
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVE-2024-38193 (severity: HIGH, weakness: CWE-416)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2024-38194 (severity: CRITICAL, weakness: CWE-20)
An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network.
CVE-2024-38195 (severity: HIGH, weakness: CWE-284)
Azure CycleCloud Remote Code Execution Vulnerability
CVE-2024-38196 (severity: HIGH, weakness: CWE-20)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-38197 (severity: MEDIUM, weakness: CWE-451)
Microsoft Teams for iOS Spoofing Vulnerability
CVE-2024-38198 (severity: HIGH, weakness: CWE-345)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2024-38199 (severity: CRITICAL, weakness: CWE-416)
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2024-3820 (severity: CRITICAL, weakness: NVD-CWE-Other)
The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of the wdt_delete_table_row AJAX action in all versions up to, and including, 6.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Please note this only affects the premium version of the plugin.
CVE-2024-38200 (severity: CRITICAL, weakness: CWE-200)
Microsoft Office Spoofing Vulnerability
CVE-2024-38201 (severity: HIGH, weakness: CWE-20)
Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2024-38202 (severity: HIGH, weakness: CWE-284)
Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further updates regarding mitigations for this vulnerability, this CVE will be updated and customers will be notified. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert if an update occurs. Details A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Update potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38202
CVE-2024-38203 (severity: MEDIUM, weakness: CWE-693)
Windows Package Library Manager Information Disclosure Vulnerability
CVE-2024-38204 (severity: MEDIUM, weakness: CWE-284)
Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.
CVE-2024-38206 (severity: MEDIUM, weakness: CWE-918)
An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.
CVE-2024-38207 (severity: MEDIUM, weakness: CWE-843)
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVE-2024-38208 (severity: MEDIUM, weakness: CWE-79)
Microsoft Edge for Android Spoofing Vulnerability
CVE-2024-38209 (severity: HIGH, weakness: CWE-843)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability