Filtered by CWE-284
Filtered by vendor Subscriptions
Total 4198 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-21531 1 Microsoft 1 Azure Service Fabric 2025-01-01 7 High
Azure Service Fabric Container Elevation of Privilege Vulnerability
CVE-2024-38016 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2025-01-01 7.8 High
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2024-43479 1 Microsoft 1 Power Automate 2025-01-01 8.5 High
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
CVE-2024-37341 1 Microsoft 5 Sql 2016 Azure Connect Feature Pack, Sql Server 2016, Sql Server 2017 and 2 more 2025-01-01 8.8 High
Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2024-43492 1 Microsoft 1 Autoupdate 2025-01-01 7.8 High
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
CVE-2024-38220 1 Microsoft 1 Azure Stack Hub 2025-01-01 9 Critical
Azure Stack Hub Elevation of Privilege Vulnerability
CVE-2024-12984 2024-12-27 5.3 Medium
A vulnerability classified as problematic has been found in Amcrest IP2M-841B, IP2M-841W, IPC-IP2M-841B, IPC-IP3M-943B, IPC-IP3M-943S, IPC-IP3M-HX2B and IPC-IPM-721S up to 20241211. This affects an unknown part of the file /web_caps/webCapsConfig of the component Web Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-0104 1 Nvidia 8 Mga100-hs2, Mlnx-gw, Mlnx-os and 5 more 2024-12-26 4.2 Medium
NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause improper access. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privileges.
CVE-2024-56330 2024-12-24 N/A
Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow users within a container to access another containers agent, therefore compromising access.The problem has been patched in any Stardust build past 12/20/24. Users are advised to upgrade. Users may also manually disable ICC if they are unable to upgrade.
CVE-2024-12896 2024-12-24 5.3 Medium
A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this issue is some unknown functionality of the file /web_caps/webCapsConfig of the component Web Interface. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor assesses that "the information disclosed in the URL is not sensitive or poses any risk to the user".
CVE-2020-3503 1 Cisco 128 1100-4g Integrated Services Router, 1100-4gltegb Integrated Services Router, 1100-4gltena Integrated Services Router and 125 more 2024-12-19 6 Medium
A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could exploit this vulnerability by connecting to an affected device's guest shell, and accessing or modifying restricted files. A successful exploit could allow the attacker to view or modify restricted information or configurations that are normally not accessible to system administrators.
CVE-2023-28809 1 Hikvision 52 Ds-k1t320efwx, Ds-k1t320efwx Firmware, Ds-k1t320efx and 49 more 2024-12-18 7.5 High
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
CVE-2024-31320 1 Google 1 Android 2024-12-17 7.8 High
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation due to CDM. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-34725 1 Google 1 Android 2024-12-17 7.0 High
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-0025 1 Google 1 Android 2024-12-17 7.8 High
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-1632 1 Progress 1 Sitefinity 2024-12-17 8.8 High
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.
CVE-2023-3306 1 Ruijie 2 Rg-ew1200g, Rg-ew1200g Firmware 2024-12-16 7.3 High
A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-231802 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-0036 1 Google 1 Android 2024-12-16 7.8 High
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-1942 1 Mattermost 1 Mattermost Server 2024-12-13 4.3 Medium
Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.
CVE-2024-29221 1 Mattermost 1 Mattermost Server 2024-12-13 4.7 Medium
Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.