CVE-2024-54131

CVE-2024-54131 (Kolide Agent / launcher, Windows): An implementation bug introduced in 1.5.3, where launcher started storing upgraded binaries in ProgramData and inherited looser root permissions, combined with an omitted SystemDrive env var when launcher starts osqueryd, enables local attackers ...

CVE-2024-54131 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)

The Kolide Agent aka: Launcher is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent known as launcher allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started...

CVE-2024-54131 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)

The Kolide Agent aka: Launcher is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent known as launcher allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started...

Exploit for Use After Free in Microsoft

CVE-2024-...

Anatomy of Celestial Stealer: Malware-as-a-Service Revealed

Anatomy of Celestial Stealer: Malware-as-a-Service Revealed By Niranjan Hegde, Adarsh S and Shashikala Piddannavar · December 3, 2024 Introduction During proactive hunting, Trellix Advanced Research Center found samples belonging to Celestial Stealer, a JavaScript-based infostealer which is...

Exploit for Improper Authentication in Microsoft

PoC exploit for CVE-2024-49039, a vulnerability in Windows Task...

Microsoft Windows Multiple Vulnerabilities (KB5046633)

This host is missing an important security update according to Microsoft KB5046633 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Patch Tuesday - November 2024

Microsoft is addressing 90 vulnerabilities this November 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and/or public disclosure for four of the vulnerabilities published today, although as with last month’s batch, it does not evaluate any of these zero-day vulnerabilities...

Microsoft Win32k 安全漏洞

Microsoft Win32k is a system file for Windows multi-user management from Microsoft USA. A security vulnerability exists in Microsoft Win32k. An attacker can exploit the vulnerability to elevate privileges. The following products and editions are affected:Windows 10 Version 1809 for 32-bit...

Microsoft Windows USB Video Class driver 缓冲区错误漏洞

Microsoft Windows USB Video Class driver is a driver for webcams or digital camcorders from Microsoft Corporation USA. A buffer error vulnerability exists in Microsoft Windows USB Video Class driver. An attacker could exploit the vulnerability to elevate privileges. The following products and...

Microsoft Windows Telephony Server 安全漏洞

Microsoft Windows Telephony Server is a component of Microsoft Corporation USA that supports the Telephony Application Programming Interface TAPI, which allows computer programs to communicate with shared telephony services. A security vulnerability exists in Microsoft Windows Telephony Server. A...

Microsoft Windows NT OS Kernel 输入验证错误漏洞

The Microsoft Windows NT OS Kernel is the core of the Windows operating system from Microsoft Corporation USA and is responsible for managing system resources, providing hardware abstraction, and ensuring system security and stability. A security vulnerability exists in the Microsoft Windows NT O...

Microsoft DWM Core Library 安全漏洞

Microsoft DWM Core Library is a core library for Microsoft windows from Microsoft Corporation, USA. A security vulnerability exists in the Microsoft DWM Core Library. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are affected:Windows Server...

Microsoft Windows Package Manager 安全漏洞

Microsoft Windows Package Manager is a comprehensive package manager solution from Microsoft Corporation USA. A system or set of tools used to automate the installation, upgrade, configuration, and use of software. Most package managers are designed to discover and install developer tools. A...

Microsoft Windows Kernel 安全漏洞

Microsoft Windows Kernel is the kernel of the Windows operating system by Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Kernel. An attacker can exploit the vulnerability to elevate privileges. The following products and versions are affected:Windows 10 Version 21...

KB5046617: Windows 11 Version 24H2 / Windows Server 2025 Security Update (November 2024)

The remote Windows host is missing security update 5046617 and Hot Patch 5046696. It is, therefore, affected by multiple vulnerabilities - Windows Kerberos Remote Code Execution Vulnerability CVE-2024-43639 - Windows NT OS Kernel Elevation of Privilege Vulnerability CVE-2024-43623 - Windows...

KB5046618: Windows Server version 23H2 Security Update (November 2024)

The remote Windows host is missing security update 5046618. It is, therefore, affected by multiple vulnerabilities - Windows Kerberos Remote Code Execution Vulnerability CVE-2024-43639 - Windows NT OS Kernel Elevation of Privilege Vulnerability CVE-2024-43623 - Windows Telephony Service Elevation...

Microsoft Windows Secure Kernel Mode 安全漏洞

Microsoft Windows Secure Kernel Mode is a security feature from Microsoft Corporation USA that uses virtualization technology to enhance system security. A security vulnerability exists in Microsoft Windows Secure Kernel Mode. An attacker could exploit the vulnerability to elevate privileges. The...

Microsoft Windows CSC Service 缓冲区错误漏洞

Microsoft Windows CSC Service is an application from Microsoft Corporation USA. It allows the use of network files while the local computer is offline. A buffer error vulnerability exists in Microsoft Windows CSC Service. An attacker exploiting this vulnerability could elevate privileges. The...

KB5046633: Windows 11 version 22H2 / 23H2 Security Update (November 2024)

The remote Windows host is missing security update 5046633. It is, therefore, affected by multiple vulnerabilities - Windows Task Scheduler Elevation of Privilege Vulnerability CVE-2024-49039 - Windows Telephony Service Remote Code Execution Vulnerability CVE-2024-43620, CVE-2024-43621,...