stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-29962 (severity: MEDIUM, weakness: CWE-276)
Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileges to access sensitive information or a Java binary.
CVE-2024-29963 (severity: LOW, weakness: CWE-798)
Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.
CVE-2024-29964 (severity: MEDIUM, weakness: CWE-732)
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.
CVE-2024-29965 (severity: MEDIUM, weakness: CWE-922)
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.
CVE-2024-29966 (severity: CRITICAL, weakness: CWE-798)
Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.
CVE-2024-29967 (severity: MEDIUM, weakness: CWE-276)
In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on the host OS to read and write access to these files.
CVE-2024-29968 (severity: MEDIUM, weakness: CWE-922)
An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.
CVE-2024-29969 (severity: HIGH, weakness: CWE-326)
When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082.
CVE-2024-2997 (severity: LOW, weakness: CWE-79)
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument Category Name/Model Name/Brand Name/Unit Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258199. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-29970 (severity: CRITICAL, weakness: NVD-CWE-Other)
Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals.
CVE-2024-29971 (severity: CRITICAL, weakness: NVD-CWE-Other)
Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals.
CVE-2024-29972 (severity: CRITICAL, weakness: CWE-78)
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVE-2024-29973 (severity: CRITICAL, weakness: CWE-78)
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVE-2024-29974 (severity: CRITICAL, weakness: CWE-434)
** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute arbitrary code by uploading a crafted configuration file to a vulnerable device.
CVE-2024-29975 (severity: MEDIUM, weakness: CWE-269)
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device.
CVE-2024-29976 (severity: MEDIUM, weakness: CWE-269)
** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an authenticated attacker to obtain a logged-in administrator’s session information containing cookies on an affected device.
CVE-2024-29977 (severity: MEDIUM, weakness: CWE-284)
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts
CVE-2024-29978 (severity: MEDIUM, weakness: CWE-256)
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVE-2024-29979 (severity: MEDIUM, weakness: CWE-754)
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
CVE-2024-2998 (severity: LOW, weakness: CWE-79)
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Store Update Page. The manipulation of the argument Store Name/Store Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258200. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-29980 (severity: MEDIUM, weakness: CWE-754)
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
CVE-2024-29981 (severity: MEDIUM, weakness: CWE-1021)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-29982 (severity: HIGH, weakness: CWE-122)
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-29983 (severity: HIGH, weakness: CWE-122)
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-29984 (severity: HIGH, weakness: CWE-122)
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-29985 (severity: HIGH, weakness: CWE-122)
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-29986 (severity: MEDIUM, weakness: CWE-359)
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
CVE-2024-29987 (severity: MEDIUM, weakness: CWE-359)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-29988 (severity: HIGH, weakness: CWE-693)
SmartScreen Prompt Security Feature Bypass Vulnerability
CVE-2024-29989 (severity: HIGH, weakness: CWE-59)
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-2999 (severity: HIGH, weakness: CWE-89)
A vulnerability classified as critical has been found in Campcodes Online Art Gallery Management System 1.0. This affects an unknown part of the file /admin/adminHome.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258201 was assigned to this vulnerability.
CVE-2024-29990 (severity: CRITICAL, weakness: CWE-284)
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVE-2024-29991 (severity: MEDIUM, weakness: CWE-94)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2024-29992 (severity: MEDIUM, weakness: CWE-522)
Azure Identity Library for .NET Information Disclosure Vulnerability
CVE-2024-29993 (severity: HIGH, weakness: CWE-284)
Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2024-29994 (severity: HIGH, weakness: CWE-125)
Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
CVE-2024-29995 (severity: HIGH, weakness: CWE-208)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2024-29996 (severity: HIGH, weakness: CWE-125)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-29997 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29998 (severity: MEDIUM, weakness: CWE-20)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29999 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-3000 (severity: CRITICAL, weakness: CWE-89)
A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability.
CVE-2024-30000 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30001 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30002 (severity: MEDIUM, weakness: CWE-20)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30003 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30004 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30005 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30006 (severity: HIGH, weakness: CWE-416)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-30007 (severity: HIGH, weakness: CWE-269)
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2024-30008 (severity: MEDIUM, weakness: CWE-191)
Windows DWM Core Library Information Disclosure Vulnerability
CVE-2024-30009 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-3001 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the file /Product.php. The manipulation of the argument value leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258203.
CVE-2024-30010 (severity: HIGH, weakness: CWE-23)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-30011 (severity: MEDIUM, weakness: CWE-191)
Windows Hyper-V Denial of Service Vulnerability
CVE-2024-30012 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30013 (severity: HIGH, weakness: CWE-415)
Windows MultiPoint Services Remote Code Execution Vulnerability
CVE-2024-30014 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30015 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30016 (severity: MEDIUM, weakness: CWE-125)
Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2024-30017 (severity: HIGH, weakness: CWE-122)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-30018 (severity: HIGH, weakness: CWE-59)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30019 (severity: MEDIUM, weakness: CWE-400)
DHCP Server Service Denial of Service Vulnerability
CVE-2024-3002 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in code-projects Online Book System 1.0. Affected is an unknown function of the file /description.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258204.
CVE-2024-30020 (severity: HIGH, weakness: CWE-122)
Windows Cryptographic Services Remote Code Execution Vulnerability
CVE-2024-30021 (severity: MEDIUM, weakness: CWE-190)
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30022 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30023 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30024 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30025 (severity: HIGH, weakness: CWE-125)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-30027 (severity: HIGH, weakness: CWE-415)
NTFS Elevation of Privilege Vulnerability
CVE-2024-30028 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2024-30029 (severity: HIGH, weakness: CWE-197)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-3003 (severity: CRITICAL, weakness: CWE-89)
A vulnerability has been found in code-projects Online Book System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cart.php. The manipulation of the argument quantity/remove leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258205 was assigned to this vulnerability.
CVE-2024-30030 (severity: HIGH, weakness: CWE-476)
Win32k Elevation of Privilege Vulnerability
CVE-2024-30031 (severity: HIGH, weakness: CWE-416)
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2024-30032 (severity: HIGH, weakness: CWE-416)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30033 (severity: HIGH, weakness: CWE-59)
Windows Search Service Elevation of Privilege Vulnerability
CVE-2024-30034 (severity: MEDIUM, weakness: CWE-843)
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
CVE-2024-30035 (severity: HIGH, weakness: CWE-416)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30036 (severity: MEDIUM, weakness: CWE-41)
Windows Deployment Services Information Disclosure Vulnerability
CVE-2024-30037 (severity: MEDIUM, weakness: CWE-125)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-30038 (severity: HIGH, weakness: CWE-122)
Win32k Elevation of Privilege Vulnerability
CVE-2024-30039 (severity: MEDIUM, weakness: CWE-126)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-3004 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in code-projects Online Book System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Product.php. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258206 is the identifier assigned to this vulnerability.
CVE-2024-30040 (severity: HIGH, weakness: CWE-20)
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2024-30041 (severity: MEDIUM, weakness: CWE-693)
Microsoft Bing Search Spoofing Vulnerability
CVE-2024-30042 (severity: HIGH, weakness: CWE-502)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-30043 (severity: HIGH, weakness: CWE-611)
Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2024-30044 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-30045 (severity: MEDIUM, weakness: CWE-122)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-30046 (severity: MEDIUM, weakness: CWE-362)
Visual Studio Denial of Service Vulnerability
CVE-2024-30047 (severity: MEDIUM, weakness: CWE-79)
Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-30048 (severity: MEDIUM, weakness: CWE-79)
Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-30049 (severity: HIGH, weakness: CWE-416)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-3005 (severity: MEDIUM, weakness: NVD-CWE-Other)
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-30050 (severity: MEDIUM, weakness: CWE-693)
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-30051 (severity: HIGH, weakness: CWE-122)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30052 (severity: MEDIUM, weakness: CWE-693)
Visual Studio Remote Code Execution Vulnerability
CVE-2024-30053 (severity: MEDIUM, weakness: CWE-79)
Azure Migrate Cross-Site Scripting Vulnerability
CVE-2024-30054 (severity: MEDIUM, weakness: CWE-20)
Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
CVE-2024-30055 (severity: MEDIUM, weakness: CWE-451)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-30056 (severity: MEDIUM, weakness: CWE-359)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-30057 (severity: MEDIUM, weakness: CWE-356)
Microsoft Edge for iOS Spoofing Vulnerability
CVE-2024-30058 (severity: MEDIUM, weakness: CWE-357)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-30059 (severity: MEDIUM, weakness: CWE-284)
Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
CVE-2024-3006 (severity: HIGH, weakness: CWE-121)
A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258292. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30060 (severity: HIGH, weakness: CWE-59)
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-30061 (severity: HIGH, weakness: CWE-285)
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2024-30062 (severity: HIGH, weakness: CWE-416)
Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
CVE-2024-30063 (severity: MEDIUM, weakness: CWE-641)
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2024-30064 (severity: HIGH, weakness: CWE-190)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30065 (severity: MEDIUM, weakness: CWE-59)
Windows Themes Denial of Service Vulnerability
CVE-2024-30066 (severity: MEDIUM, weakness: CWE-122)
Winlogon Elevation of Privilege Vulnerability
CVE-2024-30067 (severity: MEDIUM, weakness: CWE-190)
Winlogon Elevation of Privilege Vulnerability
CVE-2024-30068 (severity: HIGH, weakness: CWE-125)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30069 (severity: MEDIUM, weakness: CWE-126)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-3007 (severity: HIGH, weakness: CWE-121)
A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258293 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30070 (severity: HIGH, weakness: CWE-191)
DHCP Server Service Denial of Service Vulnerability
CVE-2024-30071 (severity: MEDIUM, weakness: CWE-126)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-30072 (severity: HIGH, weakness: CWE-190)
Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability
CVE-2024-30073 (severity: HIGH, weakness: CWE-41)
Windows Security Zone Mapping Security Feature Bypass Vulnerability
CVE-2024-30074 (severity: HIGH, weakness: CWE-122)
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVE-2024-30075 (severity: HIGH, weakness: CWE-122)
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVE-2024-30076 (severity: MEDIUM, weakness: CWE-59)
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2024-30077 (severity: HIGH, weakness: CWE-122)
Windows OLE Remote Code Execution Vulnerability
CVE-2024-30078 (severity: HIGH, weakness: CWE-20)
Windows Wi-Fi Driver Remote Code Execution Vulnerability
CVE-2024-30079 (severity: HIGH, weakness: CWE-126)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2024-3008 (severity: HIGH, weakness: CWE-121)
A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258294 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-30080 (severity: CRITICAL, weakness: CWE-416)
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-30081 (severity: HIGH, weakness: CWE-200)
Windows NTLM Spoofing Vulnerability
CVE-2024-30082 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability