stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2024-37991 (severity: MEDIUM, weakness: CWE-200)
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The service log files of the affected application can be accessed without proper authentication. This could allow an unauthenticated attacker to get access to sensitive information.
CVE-2024-37992 (severity: MEDIUM, weakness: CWE-703)
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected devices does not properly handle the error in case of exceeding characters while setting SNMP leading to the restart of the application.
CVE-2024-37993 (severity: MEDIUM, weakness: CWE-284)
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected applications do not authenticated the creation of Ajax2App instances. This could allow an unauthenticated attacker to cause a denial of service condition.
CVE-2024-37994 (severity: MEDIUM, weakness: CWE-912)
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected application contains a hidden configuration item to enable debug functionality. This could allow an attacker to gain insight into the internal configuration of the deployment.
CVE-2024-37995 (severity: LOW, weakness: CWE-703)
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected application improperly handles error while a faulty certificate upload leading to crashing of application. This vulnerability could allow an attacker to disclose sensitive information.
CVE-2024-37996 (severity: MEDIUM, weakness: CWE-476)
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter Visualization V14.2 (All versions < V14.2.0.13), Teamcenter Visualization V14.3 (All versions < V14.3.0.11), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0003). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XML files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-37997 (severity: HIGH, weakness: CWE-121)
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter Visualization V14.2 (All versions < V14.2.0.13), Teamcenter Visualization V14.3 (All versions < V14.3.0.11), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0003). The affected applications contain a stack based overflow vulnerability while parsing specially crafted XML files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-37998 (severity: CRITICAL, weakness: CWE-620)
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.
CVE-2024-37999 (severity: HIGH, weakness: CWE-282)
A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network access. This could allow an authenticated local attacker to escalate privileges.
CVE-2024-3800 (severity: MEDIUM, weakness: CWE-79)
Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in requested file names. Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.
CVE-2024-38002 (severity: HIGH, weakness: CWE-863)
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
CVE-2024-3801 (severity: MEDIUM, weakness: CWE-79)
Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in one of GET header parameters. Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears.
CVE-2024-38010 (severity: HIGH, weakness: CWE-130)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-38011 (severity: HIGH, weakness: CWE-130)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-38013 (severity: MEDIUM, weakness: CWE-59)
Microsoft Windows Server Backup Elevation of Privilege Vulnerability
CVE-2024-38014 (severity: HIGH, weakness: CWE-269)
Windows Installer Elevation of Privilege Vulnerability
CVE-2024-38015 (severity: HIGH, weakness: CWE-400)
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
CVE-2024-38016 (severity: HIGH, weakness: CWE-284)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2024-38017 (severity: MEDIUM, weakness: CWE-200)
Microsoft Message Queuing Information Disclosure Vulnerability
CVE-2024-38018 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-38019 (severity: HIGH, weakness: CWE-190)
Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability
CVE-2024-38020 (severity: MEDIUM, weakness: CWE-200)
Microsoft Outlook Spoofing Vulnerability
CVE-2024-38021 (severity: HIGH, weakness: CWE-20)
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38022 (severity: HIGH, weakness: CWE-59)
Windows Image Acquisition Elevation of Privilege Vulnerability
CVE-2024-38023 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-38024 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-38025 (severity: HIGH, weakness: CWE-122)
Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability
CVE-2024-38027 (severity: MEDIUM, weakness: CWE-400)
Windows Line Printer Daemon Service Denial of Service Vulnerability
CVE-2024-38028 (severity: HIGH, weakness: CWE-125)
Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability
CVE-2024-38029 (severity: HIGH, weakness: CWE-73)
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2024-3803 (severity: MEDIUM, weakness: CWE-434)
A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-38030 (severity: MEDIUM, weakness: CWE-200)
Windows Themes Spoofing Vulnerability
CVE-2024-38031 (severity: HIGH, weakness: CWE-400)
Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
CVE-2024-38032 (severity: HIGH, weakness: CWE-122)
Microsoft Xbox Remote Code Execution Vulnerability
CVE-2024-38033 (severity: HIGH, weakness: CWE-20)
PowerShell Elevation of Privilege Vulnerability
CVE-2024-38034 (severity: HIGH, weakness: CWE-190)
Windows Filtering Platform Elevation of Privilege Vulnerability
CVE-2024-38036 (severity: MEDIUM, weakness: CWE-79)
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
CVE-2024-38037 (severity: MEDIUM, weakness: CWE-601)
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVE-2024-38038 (severity: MEDIUM, weakness: CWE-79)
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
CVE-2024-38039 (severity: MEDIUM, weakness: CWE-80)
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).
CVE-2024-3804 (severity: MEDIUM, weakness: CWE-434)
A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-38040 (severity: HIGH, weakness: CWE-73)
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.
CVE-2024-38041 (severity: MEDIUM, weakness: CWE-200)
Windows Kernel Information Disclosure Vulnerability
CVE-2024-38043 (severity: HIGH, weakness: CWE-20)
PowerShell Elevation of Privilege Vulnerability
CVE-2024-38044 (severity: HIGH, weakness: CWE-197)
DHCP Server Service Remote Code Execution Vulnerability
CVE-2024-38045 (severity: HIGH, weakness: CWE-122)
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2024-38046 (severity: HIGH, weakness: CWE-20)
PowerShell Elevation of Privilege Vulnerability
CVE-2024-38047 (severity: HIGH, weakness: CWE-20)
PowerShell Elevation of Privilege Vulnerability
CVE-2024-38048 (severity: MEDIUM, weakness: CWE-125)
Windows Network Driver Interface Specification (NDIS) Denial of Service Vulnerability
CVE-2024-38049 (severity: HIGH, weakness: CWE-73)
Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability
CVE-2024-38050 (severity: HIGH, weakness: CWE-191)
Windows Workstation Service Elevation of Privilege Vulnerability
CVE-2024-38051 (severity: HIGH, weakness: CWE-122)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2024-38052 (severity: HIGH, weakness: CWE-20)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38053 (severity: HIGH, weakness: CWE-416)
Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
CVE-2024-38054 (severity: HIGH, weakness: CWE-122)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38055 (severity: MEDIUM, weakness: CWE-20)
Microsoft Windows Codecs Library Information Disclosure Vulnerability
CVE-2024-38056 (severity: MEDIUM, weakness: CWE-125)
Microsoft Windows Codecs Library Information Disclosure Vulnerability
CVE-2024-38057 (severity: HIGH, weakness: CWE-125)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2024-38058 (severity: MEDIUM, weakness: CWE-693)
BitLocker Security Feature Bypass Vulnerability
CVE-2024-38059 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2024-3806 (severity: CRITICAL, weakness: NVD-CWE-Other)
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2024-38060 (severity: HIGH, weakness: CWE-122)
Windows Imaging Component Remote Code Execution Vulnerability
CVE-2024-38061 (severity: HIGH, weakness: CWE-284)
DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability
CVE-2024-38062 (severity: HIGH, weakness: CWE-125)
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-38063 (severity: CRITICAL, weakness: CWE-191)
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2024-38064 (severity: HIGH, weakness: CWE-908)
Windows TCP/IP Information Disclosure Vulnerability
CVE-2024-38065 (severity: MEDIUM, weakness: CWE-122)
Secure Boot Security Feature Bypass Vulnerability
CVE-2024-38066 (severity: HIGH, weakness: CWE-416)
Windows Win32k Elevation of Privilege Vulnerability
CVE-2024-38067 (severity: HIGH, weakness: CWE-400)
Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
CVE-2024-38068 (severity: HIGH, weakness: CWE-400)
Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
CVE-2024-38069 (severity: HIGH, weakness: CWE-347)
Windows Enroll Engine Security Feature Bypass Vulnerability
CVE-2024-3807 (severity: HIGH, weakness: NVD-CWE-Other)
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. This was partially patched in version 7.1.0 and fully patched in version 7.1.1.
CVE-2024-38070 (severity: HIGH, weakness: CWE-693)
Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability
CVE-2024-38071 (severity: HIGH, weakness: CWE-126)
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-38072 (severity: HIGH, weakness: CWE-476)
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-38073 (severity: HIGH, weakness: CWE-125)
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-38074 (severity: CRITICAL, weakness: CWE-191)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38076 (severity: CRITICAL, weakness: CWE-122)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38077 (severity: CRITICAL, weakness: CWE-122)
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVE-2024-38078 (severity: HIGH, weakness: CWE-416)
Xbox Wireless Adapter Remote Code Execution Vulnerability
CVE-2024-38079 (severity: HIGH, weakness: CWE-122)
Windows Graphics Component Elevation of Privilege Vulnerability