CVE-2024-27108

CVE-2024-27108 affects GE HealthCare EchoPAC; root cause is a permission/configuration issue that allows non-privileged access to critical files. Impact per sources: confidentiality, integrity, and availability HIGH. Related entries (PT-2024-3657) describe incorrect permission assignments enablin...

CVE-2024-27107

CVE-2024-27107 concerns GE HealthCare EchoPAC with a weakness in credentials (hard-coded/predefined passwords) in the EchoPAC workflow. Affected component is EchoPAC (and related EchoPAC deployment scenarios) and the root cause is credential handling allowing unauthorized access. The connected do...

CVE-2024-27106

The CVE-2024-27106 entry concerns GE HealthCare EchoPAC products with vulnerable data in transit due to a lack of encryption. Affected component/behavior is data in transit handling, and the underlying root cause is insufficient encryption measures. Reported impact is potential unauthorized acces...

CVE-2024-30054

CVE-2024-30054 concerns the Microsoft.PowerBI.JavaScript NuGet package, specifically versions prior to 2.23.1, which are vulnerable to an information disclosure via user interaction. The Nessus plugin cites a

CVE-2024-30051

CVE-2024-30051 is an Elevation of Privilege in the Windows Desktop Window Manager (DWM) core library dwmcore.dll. The root cause is a heap-based buffer overflow in CCommandBuffer::Initialize caused by a size miscalculation (integer division) that can overflow the heap during a heap spray, allowin...

CVE-2024-30048

CVE-2024-30048 relates to a spoofing vulnerability in Microsoft Dynamics 365 Customer Insights. The connected advisories indicate an XSS-style issue that could lead to execution of arbitrary code in the victim’s browser or access to sensitive data, with exploitation requiring prior authentication...

CVE-2024-30049

CVE-2024-30049 is a Windows Win32 Kernel Subsystem elevation-of-privilege vulnerability affecting the Win32K component. Public details in connected sources indicate the issue enables elevated privileges with local access (CVSSv3.1: AV=L/AC=L/PR=L/UI=N/S=U/C=H/I=H/A=H; base score 7.8), and multipl...

CVE-2024-30046

CVE-2024-30046 is a denial-of-service vulnerability in Microsoft’s .NET/ASP.NET Core stack caused by a deadlock in Microsoft.AspNetCore.Server.Kestrel.Core.dll, leading to service unavailability. Connected advisories indicate the issue affects ASP.NET Core runtimes and associated Microsoft.AspNet...

CVE-2024-30047

CVE-2024-30047 affects Microsoft Dynamics 365 Customer Insights. The vulnerability is a spoofing issue that enables Cross-Site Scripting (XSS). Attackers require authentication, and exploitation can lead to arbitrary browser-side code execution or access to sensitive data in the victim’s browser....

CVE-2024-30043

CVE-2024-30043 affects Microsoft SharePoint Server (on-premises) and is caused by improper restriction of XML External Entity (XXE) references, enabling information disclosure. Public details include an XXE exploit example for SharePoint Server 2019 and related advisories. Affected product/versio...

CVE-2024-30045

CVE-2024-30045 is a .NET/Visual Studio Remote Code Execution vulnerability caused by a stack buffer overrun in the Double Parse routine. It affects .NET 7.0 up to 7.0.18 and .NET 8.0 up to 8.0.4; patched versions are 7.0.19 and 8.0.5 ( Microsoft/MSRC advisory; GHSA entry lists affected packages a...

CVE-2024-30042

CVE-2024-30042 affects Microsoft Excel (Office suite). The vulnerability enables remote code execution via a crafted file, with a local attack vector and requires user interaction. The CVSS v3.1 base score is 7.8 (HIGH), with confidentiality, integrity, and availability impacts all high; attack v...

CVE-2024-30041

CVE-2024-30041 – Microsoft Bing Search Spoofing Vulnerability is described in the sources as a spoofing vulnerability affecting Microsoft Bing Search. The record lists a CVSS v3.1 base score of 5.4 (Medium), with attack vector Network, require user interaction, and impact to confidentiality/ inte...

CVE-2024-30040

CVE-2024-30040 is a Windows MSHTML Platform Security Feature Bypass vulnerability. The affected component is MSHTML (Windows), with a root cause described as a security feature bypass in the MSHTML engine. Impact per CVSS: CVSS 3.1 base score 8.8 (High) affecting confidentiality, integrity, and a...

CVE-2024-30039

CVE-2024-30039 affects the Windows Remote Access Connection Manager. The connected documents map this CVE to Windows components and indicate an information-disclosure risk with CVSS 3.1/3.5-like characteristics: local access required, low attack complexity, no user interaction, confidentiality im...

CVE-2024-30037

The CVE-2024-30037 entry affects Windows Common Log File System Driver and is categorized as a local Elevation of Privilege vulnerability (requires local access; may grant elevated privileges). The connected documents corroborate the CVE mapping and indicate it is part of a set of Windows fixes; ...

CVE-2024-30036

CVE-2024-30036 – Windows Deployment Services Information Disclosure What is affected: Windows Deployment Services component of Windows. Documented as CVE-2024-30036 with an information disclosure vulnerability. What is vulnerable: The Windows Deployment Services feature exposes data confidentiali...

CVE-2024-30034

CVE-2024-30034 affects Windows Cloud Files Mini Filter Driver and is an information disclosure vulnerability. CVSSv3.1 provides a base score of 5.5 (MEDIUM), attack vector LOCAL, attack complexity LOW, privileges required LOW, no user interaction, with confidentiality impact HIGH. Exploitation st...

CVE-2024-30035

CVE-2024-30035 impacts the Windows DWM Core Library and is an Elevation of Privilege vulnerability. Documents identify the affected component (DWM Core Library) and the impact as Obtaining elevated privileges. The CVE is listed among Windows vulnerabilities fixed by Microsoft updates; remediation...

CVE-2024-30032

CVE-2024-30032 affects Windows DWM Core Library. The vulnerability enables local elevation of privilege with vector LOCAL, requiring LOW privileges and no user interaction; impact is elevated privileges potentially up to SYSTEM, with confidentiality/integrity/availability rated HIGH. The CVE is l...