Privilege escalation

Windows Group Policy Elevation of Privilege Vulnerability...

CVE-2024-20657 Windows Group Policy Elevation of Privilege Vulnerability

...

CVE-2024-20657

Technical details about CVE-2024-20657 (affected product/component, root cause, impact, fixes) are not publicly provided in the supplied documents. Monitor for updates from Microsoft and security advisories.

CVE-2024-20657 Windows Group Policy Elevation of Privilege Vulnerability

...

January 9, 2024—KB5034127 (OS Build 17763.5329) - EXPIRED

None None...

Windows Group Policy Elevation of Privilege Vulnerability

...

EDK2 Buffer Error Vulnerability

EDK2 is a set of cross-platform firmware development environments from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 202311 and earlier versions, which stems from a buffer overflow vulnerability in the Tcg2MeasureGptTable function...

Microsoft Windows Group Policy Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Group Policy. An attacker could exploit this vulnerability to gain elevated privileges. The following products an...

KB5034167: Windows Server 2008 R2 Security Update (January 2024)

The remote Windows host is missing security update 5034167. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-20654 - Windows Kerberos Security Feature Bypass Vulnerability CVE-2024-20674 - Windows Group Policy Elevation of...

KB5034184: Windows Server 2012 Security Update (January 2024)

The remote Windows host is missing security update 5034184. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-20654 - Windows Kerberos Security Feature Bypass Vulnerability CVE-2024-20674 - Windows Group Policy Elevation of...

PT-2024-1035 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in synchronization when using a shared resource in the Windows Group Policy Services. It allows an attacker to elevate their privileges. There is no informati...

KB5034171: Windows Server 2012 R2 Security Update (January 2024)

The remote Windows host is missing security update 5034171. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-20654 - Windows Kerberos Security Feature Bypass Vulnerability CVE-2024-20674 - Windows Group Policy Elevation of...

KB5034176: Windows Server 2008 Security Update (January 2024)

The remote Windows host is missing security update 5034176. It is, therefore, affected by multiple vulnerabilities - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-20654 - Windows Kerberos Security Feature Bypass Vulnerability CVE-2024-20674 - Windows Group Policy Elevation of...

Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware

The recent wave of cyber attacks targeting Albanian organizations involved the use of a wiper called No-Justice. The findings come from cybersecurity company ClearSky, which said the Windows-based malware "crashes the operating system in a way that it cannot be rebooted." The intrusions have been...

Russian Hackers Had Covert Access to Ukraine's Telecom Giant for Months

Ukrainian cybersecurity authorities have disclosed that the Russian state-sponsored threat actor known as Sandworm was inside telecom operator Kyivstar's systems at least since May 2023. The development was first reported by Reuters. The incident, described as a "powerful hacker attack," first ca...

Man Group D-Tale Code Issue Vulnerability

Man Group D-Tale is a pandas data structure visualization tool from Man Group. A code issue vulnerability exists in Man Group D-Tale versions prior to 3.9.0. An attacker could exploit the vulnerability to gain access to files on the server...

Kimsuky Group’s Intriguing Exploits with AppleSeed Malware

Summary: The Kimsuky group has been actively utilizing weaponized LNK files to deploy the AppleSeed malware. While the group typically relies on spear-phishing attacks for initial access, their recent campaigns have prominently featured the use of shortcut-type malware in LNK file format. AppleSe...

Improper Authorization

github.com/mattermost/mattermost/ is vulnerable to Improper Authorization. The vulnerability is caused when user receives updated permissions during active session. This freshly demoted guest can change group names...

CVE-2023-6981

The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'groupid' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Easy Social Feed < 6.5.3 - Subscriber+ Settings Update

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's...