CVE-2024-7553

CVE-2024-7553 concerns MongoDB components (Server and relevant drivers) on Windows, due to incorrect validation of files loaded from a local untrusted directory. The flaw can enable local privilege escalation and may cause the application to execute arbitrary behavior based on untrusted file cont...

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB...

Global Outage Alert: Windows BSOD Crisis Following CrowdStrike Update – Recovery Steps & Qualys Assurance

On Friday, July 19, 2024, morning, reports surfaced globally of Microsoft Windows operating system users encountering the infamous Blue Screen of Death BSOD following the latest update from CrowdStrike. This widespread issue has severely impacted critical services, including telecommunications,...

How to Use Multiple Activation Key (MAK) Activation with Automatic Updates

This article describes how to use Multiple Activation Key MAK Windows OS Activation with Automatic Updates. Note: For Provisioning Server 6.x and 7.x environments, using vDisk versioning is the preferred method to update MAK-enabled image. MAK activation for Microsoft Office products isNOT...

Privilege Escalation

Microsoft.IO.Redist is vulnerable to Privilege Escalation. The vulnerability is due improper link resolution in the Visual Studio installer on Windows OS that allows an unprivileged user to manipulate the installation, leading to elevated SYSTEM level privileges...

GHSA-HQ7W-XV5X-G34J Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 . This advisory also provides guidance on what developers can do to update their...

Exploit for CVE-2024-37726

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitra...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CVE-2024-37364

The CVE-2024-37364 entry concerns Ariane Allegro Scenario Player (through 2024-03-05) with Ariane Duo kiosk mode. A physically proximate attacker can access sensitive information (e.g., hotel invoices with PII) and potentially create unauthorized room keys by entering a guest-search quote charact...

CVE-2024-3863

The executable file warning was not presented when downloading .xrm-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

January 9, 2024—KB5034134 (OS Build 10240.20402) - EXPIRED

None None...

Patch Tuesday, March 2024 Edition

Apple and Microsoft recently released software updates to fix dozens of security holes in their operating systems. Microsoft today patched at least 60 vulnerabilities in its Windows OS. Meanwhile, Apples new macOS Sonoma addresses at least 68 security weaknesses, and its latest update for iOS fix...

Windows Kernel Information Disclosure Vulnerability

...

March 12, 2024—KB5035858 (OS Build 10240.20526) - EXPIRED

None None...

PT-2024-2199 · Microsoft · Odbc Driver +1

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver affected versions not specified Description: The issue is related to insufficient input validation in the ODBC driver of Windows operating systems. It allows a remote attacker to execute arbitrary code. Recommendations: ...

Splunk 9.0.4 - Information Disclosure Vulnerability

Exploit Title: Splunk 9.0.4 - Information Disclosure Date: 2023-09-18 Exploit Author: Parsa rezaie khiabanloo Vendor Homepage: https://www.splunk.com/ Version: 9.0.4 Tested on: Windows OS Splunk through 9.0.4 allows information disclosure by appending...

Splunk 9.0.4 - Information Disclosure

Exploit Title: Splunk 9.0.4 - Information Disclosure Date: 2023-09-18 Exploit Author: Parsa rezaie khiabanloo Vendor Homepage: https://www.splunk.com/ Version: 9.0.4 Tested on: Windows OS Splunk through 9.0.4 allows information disclosure by appending...

Splunk 9.0.4 Information Disclosure

Exploit Title: Splunk 9.0.4 - Information Disclosure Date: 2023-09-18 Exploit Author: Parsa rezaie khiabanloo Vendor Homepage: https://www.splunk.com/ Version: 9.0.4 Tested on: Windows OS Splunk through 9.0.4 allows information disclosure by appending...

CVE-2024-23826

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...

Design/Logic Flaw

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...