CVE & Exploit Intelligence Database

CVE-2024-38213 6.5 MEDIUM KEV EPSS 0.59

Windows Mark of the Web Security Feature Bypass Vulnerability

CWE-693 Aug 13, 2024

CVE-2024-38180 8.8 HIGH EPSS 0.07

Windows SmartScreen Security Feature Bypass Vulnerability

CWE-693 Aug 13, 2024

CVE-2024-0101 7.5 HIGH EPSS 0.01

NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enable an attacker to cause a failure by attacking the switch. A successful exploit of this vulnerability might lead to denial of service.

CWE-693 Aug 08, 2024

CVE-2023-42918 6.3 MEDIUM EPSS 0.00

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.

CWE-693 Jul 29, 2024

CVE-2024-6741 5.8 MEDIUM EPSS 0.00

Openfind's Mail2000 has a vulnerability that allows the HttpOnly flag to be bypassed. Unauthenticated remote attackers can exploit this vulnerability using specific JavaScript code to obtain the session cookie with the HttpOnly flag enabled.

CWE-693 Jul 15, 2024

CVE-2024-38092 8.8 HIGH EPSS 0.10

Azure CycleCloud Elevation of Privilege Vulnerability

CWE-693 Jul 09, 2024

CVE-2024-38070 7.8 HIGH EPSS 0.01

Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability

CWE-693 Jul 09, 2024

CVE-2024-38058 6.8 MEDIUM EPSS 0.00

BitLocker Security Feature Bypass Vulnerability

CWE-693 Jul 09, 2024

CVE-2024-39599 4.7 MEDIUM EPSS 0.00

Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability.

CWE-693 Jul 09, 2024

CVE-2024-27713 8.8 HIGH EPSS 0.01

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component.

CWE-693 Jul 05, 2024

CVE-2024-29510 6.3 MEDIUM EXPLOITED 2 PoCs Analysis EPSS 0.07

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

CWE-693 Jul 03, 2024

CVE-2024-38874 5.4 MEDIUM EPSS 0.00

An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.

CWE-693 Jun 21, 2024

CVE-2024-6153 7.8 HIGH EPSS 0.00

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-19481.

CWE-693 Jun 20, 2024

CVE-2024-37182 4.7 MEDIUM EPSS 0.00

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.

CWE-693 Jun 14, 2024

CVE-2024-36287 3.8 LOW EPSS 0.00

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.

CWE-693 Jun 14, 2024

CVE-2024-5924 8.8 HIGH EPSS 0.00

Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of shared folders. When syncing files from a shared folder belonging to an untrusted account, the Dropbox desktop application does not apply the Mark-of-the-Web to the local files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-23991.

CWE-693 Jun 13, 2024

CVE-2024-30052 4.7 MEDIUM 1 PoC Analysis EPSS 0.02

Visual Studio Remote Code Execution Vulnerability

CWE-693 Jun 11, 2024

CVE-2024-5691 4.7 MEDIUM EPSS 0.00

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CWE-693 Jun 11, 2024

CVE-2024-31142 7.5 HIGH EPSS 0.03

Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html

CWE-693 May 16, 2024

CVE-2024-30050 5.4 MEDIUM EPSS 0.09

Windows Mark of the Web Security Feature Bypass Vulnerability

CWE-693 May 14, 2024