CVE Vulnerability Advisory Database

[Affected Scope] Windows 10, 11, and Windows Server systems utilizing the Common Log File System (CLFS) driver

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, escalating privileges to SYSTEM

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict unauthorized creation of CLFS log (.blf) files

[Affected Scope] Systems running the Linux kernel with the UVC (USB Video Class) driver enabled

[Impact] A local attacker can trigger an out-of-bounds write in kernel memory via a malicious USB device, leading to Local Privilege Escalation (LPE) or Kernel Panic (DoS)

[Mitigation] Apply the latest stable Linux kernel security patches or blacklist the uvcvideo kernel module if not required

[Affected Scope] Systems running macOS Sequoia prior to 15.1.1, iOS/iPadOS prior to 18.1.1 and 17.7.2, and Safari prior to 18.1.1

[Impact] Processing maliciously crafted web content can trigger a Cross-Site Scripting (XSS) attack due to state management flaws, with active exploitation reported on Intel-based Mac systems

[Mitigation] Immediately apply the official software updates provided by Apple for macOS, iOS, iPadOS, and Safari

[Affected Scope] Apple devices running Safari prior to 18.1.1, iOS/iPadOS 17/18, macOS Sequoia, and visionOS

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution and complete device compromise

[Mitigation] Immediately apply the official security updates released by Apple (iOS 18.1.1, macOS 15.1.1, etc.)

[Affected Scope] All Linux kernel-based systems utilizing HID (Human Interface Device) drivers

[Impact] Local attackers can exploit uninitialized memory buffers to leak sensitive kernel memory contents via specially-crafted HID reports

[Mitigation] Apply the latest stable kernel updates provided by your Linux distribution and reboot the system

[Affected Scope] Mobile devices running Android OS utilizing the ExternalStorageProvider component

[Impact] Local attackers can bypass file path filters to access sensitive system directories, leading to local privilege escalation without requiring elevated execution privileges

[Mitigation] Apply the Google Android March 2025 security patch and upgrade device firmware to the latest version

[Affected Scope] Authenticated users within the same Windows Active Directory domain as the Citrix Session Recording server

[Impact] Privilege escalation to 'NetworkService' account, enabling unauthorized system control and potential lateral movement within the AD domain

[Mitigation] Immediately upgrade Citrix Session Recording components to the latest patched versions recommended by the vendor

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A local attacker with low privileges can bypass security boundaries via RPC interfaces to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft November 2024 Security Update and restrict local user privileges

[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems

[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks

[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls

[Affected Scope] Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0

[Impact] An attacker can achieve arbitrary remote code execution (RCE) within the browser's content process, with active exploitation reported in the wild

[Mitigation] Immediately update all affected installations to the latest patched versions (Firefox 131.0.2+, ESR 128.3.1+, ESR 115.16.1+, Thunderbird 131.0.1+, 128.3.1+, 115.16.0+)

[Affected Scope] All supported versions of Windows client and server operating systems utilizing the MSHTML (Internet Explorer) engine.

[Impact] Attackers can bypass security warnings and spoof trusted domains to steal sensitive credentials or execute malicious payloads by tricking users into visiting crafted web content.

[Mitigation] Immediately apply the October 2024 Microsoft cumulative security updates and restrict MSHTML execution via registry hardening.

[Affected Scope] Microsoft Windows operating systems utilizing Microsoft Management Console (MMC) and .msc console files

[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a crafted .msc file

[Mitigation] Apply the official Microsoft security updates immediately and restrict the execution of untrusted .msc files

[Affected Scope] Systems running unpatched versions impacted by CVE-2024-9380

[Impact] An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker wit...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing specific HLOS (High-Level Operating System) memory drivers

[Impact] Local attackers with low privileges can trigger a Use-After-Free (UAF) condition, leading to kernel memory corruption and full local privilege escalation (LPE) to root

[Mitigation] Apply the official security patches released by OEMs (October 2024 or later) and restrict access to kernel memory drivers using strict SELinux policies

[Affected Scope] All supported versions of Microsoft Windows client and server operating systems utilizing the MSHTML platform

[Impact] Attackers can spoof file extensions to trick users into executing malicious payloads, leading to potential Remote Code Execution (RCE)

[Mitigation] Apply the Microsoft September 2024 cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] Microsoft Publisher 2016, Office LTSC 2021, and Microsoft 365 Apps within supported lifecycles

[Impact] An attacker can bypass Office macro block policies and Mark of the Web (MOTW) security warnings to execute arbitrary code when a user opens a specially crafted Publisher file

[Mitigation] Apply the official Microsoft security updates immediately and enforce Group Policies to block macros in files originating from the Internet

[Affected Scope] Windows 10, Windows 11, and Windows Server environments with Smart App Control or Windows Defender SmartScreen enabled

[Impact] Attackers can bypass Mark of the Web (MotW) warnings, allowing malicious files to execute without triggering security prompts to the user

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the execution of untrusted container/shortcut files

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions

[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code

[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users

[Affected Scope] Google Chrome prior to 128.0.6613.84 and all affected Chromium-based browsers (e.g., Microsoft Edge)

[Impact] Remote attackers can trigger heap corruption and execute arbitrary code within the browser renderer process via a crafted HTML page

[Mitigation] Immediately update all Chromium-based browsers to the latest stable release (Chrome 128.0.6613.84 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 128.0.6613.84

[Impact] A remote attacker can trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution (RCE) within the browser process

[Mitigation] Immediately update Google Chrome to the latest stable version (128.0.6613.84/.85 or higher)