CVE Vulnerability Advisory Database

[Affected Scope] All supported versions of Windows client and server operating systems utilizing the MSHTML (Internet Explorer) engine.

[Impact] Attackers can bypass security warnings and spoof trusted domains to steal sensitive credentials or execute malicious payloads by tricking users into visiting crafted web content.

[Mitigation] Immediately apply the October 2024 Microsoft cumulative security updates and restrict MSHTML execution via registry hardening.

[Affected Scope] Microsoft Windows operating systems utilizing Microsoft Management Console (MMC) and .msc console files

[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a crafted .msc file

[Mitigation] Apply the official Microsoft security updates immediately and restrict the execution of untrusted .msc files

[Affected Scope] All supported versions of Microsoft Windows client and server operating systems utilizing the MSHTML platform

[Impact] Attackers can spoof file extensions to trick users into executing malicious payloads, leading to potential Remote Code Execution (RCE)

[Mitigation] Apply the Microsoft September 2024 cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] Windows 10, Windows 11, and Windows Server environments with Smart App Control or Windows Defender SmartScreen enabled

[Impact] Attackers can bypass Mark of the Web (MotW) warnings, allowing malicious files to execute without triggering security prompts to the user

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the execution of untrusted container/shortcut files

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions

[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code

[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass Mark of the Web (MotW) security warnings, leading users to execute malicious files without any security prompts

[Mitigation] Apply the official Microsoft security updates immediately and harden SmartScreen policies

[Affected Scope] Most versions of Windows 10, 11, and Windows Server 2008 through 2022

[Impact] Local attackers can exploit kernel memory corruption to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft August 2024 security updates and monitor for unauthorized local account activities

[Affected Scope] Windows 10, 11, and Windows Server environments utilizing the legacy JScript9 engine, particularly with Internet Explorer mode enabled

[Impact] Remote Code Execution (RCE) and full system compromise via specially crafted malicious web pages

[Mitigation] Apply the Microsoft August 2024 security updates immediately and disable legacy IE scripting engines where applicable

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A locally authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to full host compromise

[Mitigation] Immediately apply the Microsoft official cumulative security updates released in August 2024 or later

[Affected Scope] Windows 10, 11, and Windows Server 2008 through 2022 environments

[Impact] A local attacker with low privileges can exploit a race condition to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply the Microsoft August 2024 security updates and restrict local access on unpatched systems

[Affected Scope] MSHTML (Internet Explorer) engine embedded in all supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass security warnings via specially crafted Internet Shortcut (.url) files, leading to arbitrary code execution and complete system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .url and .lnk files

[Affected Scope] Windows 10, Windows 11, and Windows Server environments running the Hyper-V virtualization platform

[Impact] Local attackers with low-privilege access can exploit an integer overflow (CWE-190) to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Immediately apply Microsoft's July 2024 cumulative security updates and restrict local access to virtualization hosts

[Affected Scope] Most supported Windows 10, 11, and Windows Server 2016, 2019, 2022 operating system kernel environments.

[Impact] A local attacker with low privileges can exploit an untrusted pointer dereference (CWE-822) to execute arbitrary code with SYSTEM privileges.

[Mitigation] Immediately apply the latest Windows Cumulative Updates (June 2024 or later) and monitor for Indicators of Compromise (IoCs).

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems

[Impact] Local attackers can exploit a TOCTOU race condition in the kernel to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft Cumulative Updates and restrict local access on unpatched systems

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Desktop Window Manager (DWM) Core Library

[Impact] Local attackers can trigger a heap-based buffer overflow to execute arbitrary code with SYSTEM privileges, leading to full host compromise

[Mitigation] Immediately apply the Microsoft May 2024 Patch Tuesday cumulative security updates and restrict unauthorized local access

[Affected Scope] Windows client and server operating systems utilizing the Windows MSHTML platform

[Impact] Attackers can bypass security warnings and protection mechanisms to execute remote code via malicious files loading OLE objects with user interaction

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict execution of untrusted files and email attachments

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server utilizing Microsoft Defender SmartScreen

[Impact] Attackers can bypass Mark-of-the-Web (MotW) warnings and SmartScreen prompts entirely, leading to arbitrary code execution when a user opens a crafted malicious file

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict the execution of unverified downloaded files via Group Policy

[Affected Scope] Broad range of Windows operating systems including Windows 10, 11, and Windows Server 2008 through 2022

[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Immediately apply Microsoft official security patches and monitor for anomalous child processes spawned by the WER service

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass Windows Defender SmartScreen warnings using crafted Internet Shortcut (.url) files to execute arbitrary code

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic