CVE-2024-28920

CVE-2024-28920 is a Secure Boot security feature bypass vulnerability. The connected ENISA/NCSC records indicate this CVE is associated with Microsoft Windows Secure Boot components and is classified as bypassing a security measure. The NVD entry confirms a Secure Boot bypass description, and rel...

CVE-2024-26232

The CVE-2024-26232 entry describes a Remote Code Execution vulnerability in Microsoft Message Queuing (MSMQ). The available details indicate a LOCAL attack with LOW privileges required and USER INTERACTION required, with HIGH impact on confidentiality, integrity, and availability (CVSS 7.3). The ...

CVE-2024-26158

CVE-2024-26158 affects Microsoft Windows Install Service and is an Elevation of Privilege vulnerability. It is exploitable locally (attack vector: Local) with low privileges required and no user interaction, potentially granting complete control (confidentiality/integrity/availability impact: Hig...

CVE-2024-26205

CVE-2024-26205 is a Windows RRAS remote code execution vulnerability. Connected sources corroborate that it is network-exploitable with a high base score (8.8) and requires user interaction, enabling remote code execution with high impact on confidentiality, integrity and availability. The issue ...

CVE-2024-26200

CVE-2024-26200 is a Windows Routing and Remote Access Service (RRAS) remote code execution vulnerability. Connected sources list RRAS as vulnerable and indicate the impact as executing random code, with CVE-2024-26200 appearing under RRAS in the Microsoft Windows vulnerabilities compilation. The ...

CVE-2024-26179

CVE-2024-26179 affects Windows Routing and Remote Access Service (RRAS) with a remote code execution vulnerability (CVSS v3.1: 8.8, HIGH). The entry specifies network attack vector with no privileges required but user interaction required, leading to execution of arbitrary code on affected system...

CVE-2024-26256

CVE-2024-26256 is a Libarchive remote code execution vulnerability. Multiple connected sources confirm a flaw in the libarchive library (notably in the rar e8 filter) that can lead to arbitrary code execution when processing crafted RAR archives. Public mitigations are version-specific: Debian li...

CVE-2024-26172

CVE-2024-26172 affects Windows DWM Core Library. Affects the Windows DWM Core Library component; root cause described as information disclosure. Documented impact is access to sensitive data with a CVSS v3.1 base score of 5.5 (LOCAL, LOW privileges required, user interaction none, availability im...

CVE-2024-26255

CVE-2024-26255 is a Windows RRAS/Windows Remote Access Connection Manager information disclosure vulnerability. The affected component is Windows Remote Access Connection Manager; the underlying issue yields leakage of sensitive data (confidentiality impact). The CVSS 3.1 vector from the initial ...

CVE-2024-26253

CVE-2024-26253 corresponds to a Windows rndismp6.sys remote code execution vulnerability. The entry notes an affected Windows component (rndismp6.sys) and an exploit path that could allow remote code execution with a high impact on confidentiality, integrity, and availability, while the attack ve...

CVE-2024-26250

CVE-2024-26250 is a Windows Secure Boot vulnerability categorized as a circumvention of security measures. The connected advisory (NCSC) lists CVE-2024-26250 under the Windows Secure Boot section with that impact. The available documents do not provide product version ranges or exact vulnerable c...

CVE-2024-26252

CVE-2024-26252 refers to a Windows kernel vulnerability in the rndismp6.sys driver that enables remote code execution. The issue is described as affecting the Windows component rndismp6.sys with a CVSSv3.1 base score of 6.8 (Medium), and usability concerns indicate a physical attack vector, low a...

CVE-2024-21409

CVE-2024-21409 is described in the provided documents as a .NET family remote code execution vulnerability affecting .NET/.NET Framework and related SDKs. Concrete details in connected sources indicate affected products/versions include .NET Core/.NET SDKs prior to 6.0.29, 7.0.18, or 8.0.4, with ...

CVE-2024-21424

Azure Compute Gallery Elevation of Privilege Vulnerability (CVE-2024-21424) affects Microsoft Azure Compute Gallery. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N with a base score of 6.5 (Medium). The issue enables privilege escalation via a component/feature within the Azu...

CVE-2024-20689

CVE-2024-20689 is a Secure Boot security feature bypass affecting Windows Secure Boot. Public materials in the provided documents describe a buffer overflow in the Secure Boot protocol implementation as a potential root cause (PT-2024-2784). CVSS data in the ESU context indicates a base score aro...

CVE-2024-20669

CVE-2024-20669 affects Microsoft Windows Secure Boot. It is a Local, High-Privilege vulnerability classed as a Secure Boot security feature bypass with a CVSS v3.1 base score of 6.7 (Impact: Confidentiality, Integrity, and Availability High). Connected sources confirm Windows Secure Boot-related ...

CVE-2024-20688

CVE-2024-20688 is a Windows Secure Boot Security Feature Bypass vulnerability. Affected component: Secure Boot implementation in Windows; root cause described as a security feature bypass with high-impact across confidentiality, integrity, and availability (CVSSv3.1 base 7.1). Attack vector is ad...

CVE-2024-31865

CVE-2024-31865 affects Apache Zeppelin due to an Improper Input Validation in the cron API, allowing arbitrary user impersonation with insufficient privileges. Affected versions are 0.8.2 up to before 0.11.1; upgrading to 0.11.1 or later fixes the issue. The CVE entry and linked sources (Red Hat,...

CVE-2023-41677

CVE-2023-41677 affects Fortinet FortiProxy and FortiOS versions listed in the description, where a vulnerability due to insufficient protection of credentials could let an attacker execute unauthorized code or commands through a targeted social engineering attack. The issue is documented across m...

CVE-2024-31487

Fortinet FortiSandbox suffers a path-traversal information-disclosure vulnerability (CVE-2024-31487) affecting FortiSandbox versions 2.4.0–2.4.1, 2.5.0–2.5.2, 3.0.0–3.0.7, 3.1.0–3.1.5, 3.2.0–3.2.4, 4.0.0–4.0.5, 4.2.0–4.2.6, and 4.4.0–4.4.4, allowing an attacker to disclose information via crafted...