Report Name: Microsoft Patch Tuesday, April 2024
Generated: 2024-04-10 13:04:14

Product Name	Prevalence	U	C	H	M	L	A	Comment
Windows SMB	1			1			1	Windows component
Intel(R) Processor	0.9			1			1	Intel's processors from the pioneering 4-bit 4004 (1971) to the present high-end offerings
Windows DNS Server	0.9			7			7	Windows component
Windows Kernel	0.9			2			2	Windows Kernel
Windows Win32k	0.9			1			1	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
.NET Framework	0.8			1			1	.NET Framework
BitLocker	0.8			1			1	A full volume encryption feature included with Microsoft Windows versions starting with Windows Vista
Chromium	0.8			5	10		15	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
Microsoft Defender for IoT	0.8			6			6	Microsoft Defender for IoT provides comprehensive threat detection for IoT/OT environments
Microsoft Edge	0.8			3	2		5	Web browser
Outlook for Windows	0.8			1			1	Windows component
RPC	0.8			1			1	Remote Procedure Call Runtime
Secure Boot	0.8			24			24	Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM)
Windows Authentication	0.8			2			2	Windows component
Windows CSC Service	0.8			1			1	Windows component
Windows Cryptographic Services	0.8			2			2	Windows component
Windows DWM Core Library	0.8			1			1	Windows component
Windows Defender Credential Guard	0.8			1			1	Windows component
Windows Distributed File System (DFS)	0.8			2			2	Windows component
Windows File Server Resource Management Service	0.8			1			1	Windows component
Windows Kerberos	0.8			2			2	Windows component
Windows Mobile Hotspot	0.8			1			1	Windows component
Windows Remote Access Connection Manager	0.8			7			7	Windows component
Windows Routing and Remote Access Service (RRAS)	0.8			3			3	Windows component
Windows Storage	0.8			1			1	Windows component
Windows Telephony Server	0.8			3			3	Windows component
Windows USB Print Driver	0.8			1			1	Windows component
Windows Update Stack	0.8			2			2	Windows component
Windows rndismp6.sys	0.8			2			2	Windows component
Microsoft Excel	0.6			1			1	MS Office product
Windows Hyper-V	0.6				1		1	Hardware virtualization component of the client editions of Windows NT
.NET, .NET Framework, and Visual Studio	0.5			1			1	.NET, .NET Framework, and Visual Studio
Azure AI Search	0.5				1		1	Azure AI Search
Azure Arc-enabled Kubernetes Extension Cluster-Scope	0.5			1			1	Azure Arc-enabled Kubernetes Extension Cluster-Scope
Azure Compute Gallery	0.5			1			1	Azure Compute Gallery
Azure CycleCloud	0.5			1			1	Azure CycleCloud
Azure Identity Library for .NET	0.5			1			1	Azure Identity Library for .NET
Azure Migrate	0.5			1			1	Azure Migrate
Azure Monitor Agent	0.5			1			1	Azure Monitor Agent
Azure Private 5G Core	0.5				1		1	Azure Private 5G Core
DHCP Server Service	0.5			4			4	DHCP Server Service
HTTP.sys	0.5			1			1	HTTP.sys
Libarchive	0.5			1			1	Multi-format archive and compression library
Microsoft Azure Kubernetes Service Confidential Container	0.5			1			1	Microsoft Azure Kubernetes Service Confidential Container
Microsoft Brokering File System	0.5			4			4	Microsoft Brokering File System
Microsoft Edge (Chromium-based) Webview2	0.5				1		1	Microsoft Edge (Chromium-based) Webview2
Microsoft Install Service	0.5			1			1	Microsoft Install Service
Microsoft Local Security Authority Subsystem Service	0.5			1			1	Microsoft Local Security Authority Subsystem Service
Microsoft Message Queuing (MSMQ)	0.5			2			2	Microsoft Message Queuing (MSMQ)
Microsoft ODBC Driver for SQL Server	0.5			13			13	Microsoft ODBC Driver for SQL Server
Microsoft OLE DB Driver for SQL Server	0.5			25			25	Microsoft OLE DB Driver for SQL Server
Microsoft SharePoint Server	0.5			1			1	Microsoft SharePoint Server
Microsoft Virtual Machine Bus (VMBus)	0.5			1			1	Microsoft Virtual Machine Bus (VMBus)
Microsoft WDAC OLE DB Provider for SQL Server	0.5			2			2	Microsoft WDAC OLE DB Provider for SQL Server
Microsoft WDAC SQL Server ODBC Driver	0.5			1			1	Microsoft WDAC SQL Server ODBC Driver
Proxy Driver	0.5			1			1	Proxy Driver
SmartScreen Prompt	0.5			1			1	SmartScreen Prompt
Xbox Gaming Services	0.5			1			1	Xbox Gaming Services
Unknown Product	0				1	1	2	Unknown Product

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0			68			68
Security Feature Bypass	0.9			31			31
Elevation of Privilege	0.85			32			32
Information Disclosure	0.83			13	1		14
Denial of Service	0.7			5	2		7
Memory Corruption	0.5			3	8		11
Spoofing	0.4			3	6		9
Unknown Vulnerability Type	0					1	1

Source	U	C	H	M	L	A
MS PT Extended			10	13		23
Qualys			20			20
Tenable			67			67
Rapid7			7			7
ZDI			5			5

Urgent (0)

Critical (0)

High (155)

1. Spoofing - Proxy Driver (CVE-2024-26234) - High [573]

Description: Proxy Driver Spoofing Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

Rapid7: Microsoft is addressing 149 vulnerabilities this April 2024 Patch Tuesday, which is significantly more than usual. For the second month in a row, Microsoft indicated that they weren't aware of prior public disclosure or exploitation in the wild for any of the vulnerabilities patched today. However, later in the day, Microsoft subsequently updated the advisory for CVE-2024-26234 to acknowledge in-the-wild exploitation and public disclosure of the exploit. There are no new additions to CISA KEV at time of writing.

Rapid7: When originally published, the advisory for CVE-2024-26234 did not indicate that Microsoft was aware of in-the-wild exploitation or public exploit disclosure. However, late on the day of publication, Microsoft updated the advisory to acknowledge awareness of both in-the-wild exploitation and public disclosure.

Rapid7: 2024-04-09: Updated discussion of vuln diclosure prior to publication to reflect Microsoft's update to the advisory for CVE-2024-26234.

ZDI: *Note that post-release, Microsoft confirmed CVE-2024-26234 is also under active attack. The table has been updated to reflect this new information. * Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

2. Remote Code Execution - Microsoft Excel (CVE-2024-26257) - High [535]

Description: Microsoft Excel Remote Code Execution Vulnerability

Rapid7: Microsoft is patching a single Office vulnerability today. CVE-2024-26257 describes a RCE vulnerability in Excel; exploitation requires that the attacker convinces the user to open a specially-crafted malicious file.

3. Remote Code Execution - Microsoft Defender for IoT (CVE-2024-21323) - High [520]

Description: Microsoft Defender for IoT Remote Code Execution Vulnerability

Qualys: CVE-2024-21323: Microsoft Defender for IoT Remote Code Execution Vulnerability To exploit this path traversal vulnerability, an attacker must send a tar file to the Defender for the IoT sensor. After the extraction process, the attacker may send unsigned update packages and overwrite any file they choose. The attacker must first authenticate themselves and gain the necessary permissions to initiate the update process.

Rapid7: CVE-2024-21323 describes an update-based attack and requires prior authentication; an attacker with the ability to control how a Defender for IoT sensor receives updates could cause the sensor device to apply a malicious update package, overwriting arbitrary files on the sensor filesystem via a path traversal weakness.

4. Remote Code Execution - Microsoft Defender for IoT (CVE-2024-29053) - High [520]

Description: Microsoft Defender for IoT Remote Code Execution Vulnerability

Qualys: CVE-2024-29053: Microsoft Defender for IoT Remote Code Execution Vulnerability An attacker must be authenticated to exploit the vulnerability, but no admin or other elevated privileges are required. Successful exploitation of this path traversal vulnerability requires an authenticated attacker, with access to the file upload feature, to upload malicious files to sensitive locations on the server.

Rapid7: Exploitation of CVE-2024-29053 allows arbitrary file upload for any authenticated user, also via a path traversal weakness, although the advisory does not specify what the target is other than “the server”.

5. Remote Code Execution - RPC (CVE-2024-20678) - High [520]

Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability

ZDI: CVE-2024-20678 – Remote Procedure Call Runtime Remote Code Execution Vulnerability. There is a long history of RPC exploits being seen in the wild, so any RPC bug that could lead to code execution turns heads. This bug does require authentication, but it doesn’t require any elevated permission. Any authenticated user could hit it. It’s not clear if you could hit this if you authenticated as Guest or an anonymous user. A quick search shows about 1.3 million systems with TCP port 135 exposed to the internet. I expect a lot of people will be looking to exploit this in short order.

6. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2024-26179) - High [520]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

7. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2024-26200) - High [520]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

8. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2024-26205) - High [520]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

9. Elevation of Privilege - Windows SMB (CVE-2024-26245) - High [514]

Description: Windows SMB Elevation of Privilege Vulnerability

10. Remote Code Execution - Windows DNS Server (CVE-2024-26221) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

ZDI: CVE-2024-26221 – Windows DNS Server Remote Code Execution Vulnerability. This is one of seven DNS RCE bugs being patched this month and all are documented identically. These bugs allow RCE on an affected DNS server if the attacker has the privileges to query the DNS server. There is a timing factor here as well, but if the DNS queries are timed correctly, the attacker can execute arbitrary code on the target server. Although not specifically stated, it seems logical that the code execution would occur at the level of the DNS service, which is elevated. I really don’t need to tell you that your DNS servers are critical targets, so please take these bugs seriously and test and deploy the patches quickly.

11. Remote Code Execution - Windows DNS Server (CVE-2024-26222) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

12. Remote Code Execution - Windows DNS Server (CVE-2024-26223) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

13. Remote Code Execution - Windows DNS Server (CVE-2024-26224) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

14. Remote Code Execution - Windows DNS Server (CVE-2024-26227) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

15. Remote Code Execution - Windows DNS Server (CVE-2024-26231) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

16. Remote Code Execution - Windows DNS Server (CVE-2024-26233) - High [513]

Description: Windows DNS Server Remote Code Execution Vulnerability

17. Remote Code Execution - Windows Cryptographic Services (CVE-2024-29050) - High [508]

Description: Windows Cryptographic Services Remote Code Execution Vulnerability

18. Information Disclosure - .NET Framework (CVE-2024-29059) - High [501]

Description: .NET Framework Information Disclosure Vulnerability

MS PT Extended: CVE-2024-29059 was published before April 2024 Patch Tuesday from 2024-03-13 to 2024-04-08

19. Elevation of Privilege - Windows Kernel (CVE-2024-20693) - High [498]

Description: Windows Kernel Elevation of Privilege Vulnerability

20. Elevation of Privilege - Windows Kernel (CVE-2024-26218) - High [498]

Description: Windows Kernel Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

21. Elevation of Privilege - Windows Win32k (CVE-2024-26241) - High [498]

Description: Win32k Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

22. Remote Code Execution - Microsoft Defender for IoT (CVE-2024-21322) - High [496]

Description: Microsoft Defender for IoT Remote Code Execution Vulnerability

Qualys: CVE-2024-21322: Microsoft Defender for IoT Remote Code Execution Vulnerability Microsoft Defender for IoT is a tool that provides visibility and security across a network by identifying specialized protocols, devices, and machine-to-machine (M2M) behaviors. The tool protects enterprise IoT networks and supports cloud, on-premises, and hybrid OT networks. An attacker must be an administrator of the web application to exploit the vulnerability. Successful exploitation of the vulnerability may lead to remote code execution on target systems.

Rapid7: The advisory for CVE-2024-21322 is light on detail, but notes that exploitation requires the attacker to have existing administrative access to the Defender for IoT web application; this limits the attacker value in isolation, although the potential for insider threat or use as part of an exploit chain remains.

Rapid7: The addition of CWE assessments to Microsoft security advisories helps pinpoint the generic root cause of a vulnerability; e.g., CVE-2024-21322 is assigned “CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').” By embracing CWE taxonomy, Microsoft is moving away from its own proprietary system to describe root cause. The CWE program has recently updated its guidance on mapping CVEs to a CWE Root Cause.

23. Remote Code Execution - Windows Distributed File System (DFS) (CVE-2024-29066) - High [496]

Description: Windows Distributed File System (DFS) Remote Code Execution Vulnerability

24. Remote Code Execution - Windows rndismp6.sys (CVE-2024-26252) - High [496]

Description: Windows rndismp6.sys Remote Code Execution Vulnerability

25. Remote Code Execution - Windows rndismp6.sys (CVE-2024-26253) - High [496]

Description: Windows rndismp6.sys Remote Code Execution Vulnerability

26. Security Feature Bypass - Chromium (CVE-2024-2630) - High [490]

Description: Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

MS PT Extended: CVE-2024-2630 was published before April 2024 Patch Tuesday from 2024-03-13 to 2024-04-08

27. Security Feature Bypass - Microsoft Edge (CVE-2024-26163) - High [490]

Description: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

MS PT Extended: CVE-2024-26163 was published before April 2024 Patch Tuesday from 2024-03-13 to 2024-04-08

28. Security Feature Bypass - Secure Boot (CVE-2024-26175) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26175||Secure Boot Security Feature Bypass Vulnerability||7.8|

29. Security Feature Bypass - Secure Boot (CVE-2024-26180) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26180||Secure Boot Security Feature Bypass Vulnerability||8|

Tenable: Four of the 24 CVEs were assigned a CVSSv3 score of 8.0. They include CVE-2024-26240, CVE-2024-26189, CVE-2024-28925 and CVE-2024-26180. Exploitation of all of these flaws do require an attacker to have either physical access or local administrator privileges on the vulnerable device.

30. Security Feature Bypass - Secure Boot (CVE-2024-26189) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26189||Secure Boot Security Feature Bypass Vulnerability||8|

Tenable: Four of the 24 CVEs were assigned a CVSSv3 score of 8.0. They include CVE-2024-26240, CVE-2024-26189, CVE-2024-28925 and CVE-2024-26180. Exploitation of all of these flaws do require an attacker to have either physical access or local administrator privileges on the vulnerable device.

31. Security Feature Bypass - Secure Boot (CVE-2024-26240) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26240||Secure Boot Security Feature Bypass Vulnerability||8|

Tenable: Four of the 24 CVEs were assigned a CVSSv3 score of 8.0. They include CVE-2024-26240, CVE-2024-26189, CVE-2024-28925 and CVE-2024-26180. Exploitation of all of these flaws do require an attacker to have either physical access or local administrator privileges on the vulnerable device.

32. Security Feature Bypass - Secure Boot (CVE-2024-28896) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28896||Secure Boot Security Feature Bypass Vulnerability||7.5|

33. Security Feature Bypass - Secure Boot (CVE-2024-28920) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28920||Secure Boot Security Feature Bypass Vulnerability||7.8|

34. Security Feature Bypass - Secure Boot (CVE-2024-28925) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28925||Secure Boot Security Feature Bypass Vulnerability||8|

Tenable: Four of the 24 CVEs were assigned a CVSSv3 score of 8.0. They include CVE-2024-26240, CVE-2024-26189, CVE-2024-28925 and CVE-2024-26180. Exploitation of all of these flaws do require an attacker to have either physical access or local administrator privileges on the vulnerable device.

35. Security Feature Bypass - Secure Boot (CVE-2024-29061) - High [490]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-29061||Secure Boot Security Feature Bypass Vulnerability||7.8|

36. Security Feature Bypass - Windows Cryptographic Services (CVE-2024-26228) - High [490]

Description: Windows Cryptographic Services Security Feature Bypass Vulnerability

37. Elevation of Privilege - Windows Authentication (CVE-2024-21447) - High [481]

Description: Windows Authentication Elevation of Privilege Vulnerability

38. Elevation of Privilege - Windows CSC Service (CVE-2024-26229) - High [481]

Description: Windows CSC Service Elevation of Privilege Vulnerability

39. Elevation of Privilege - Windows Defender Credential Guard (CVE-2024-26237) - High [481]

Description: Windows Defender Credential Guard Elevation of Privilege Vulnerability

40. Elevation of Privilege - Windows Kerberos (CVE-2024-26248) - High [481]

Description: Windows Kerberos Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

41. Elevation of Privilege - Windows Remote Access Connection Manager (CVE-2024-26211) - High [481]

Description: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

42. Elevation of Privilege - Windows Storage (CVE-2024-29052) - High [481]

Description: Windows Storage Elevation of Privilege Vulnerability

43. Elevation of Privilege - Windows Telephony Server (CVE-2024-26230) - High [481]

Description: Windows Telephony Server Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

44. Elevation of Privilege - Windows Telephony Server (CVE-2024-26239) - High [481]

Description: Windows Telephony Server Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

45. Elevation of Privilege - Windows Update Stack (CVE-2024-26235) - High [481]

Description: Windows Update Stack Elevation of Privilege Vulnerability

46. Security Feature Bypass - Secure Boot (CVE-2024-20669) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-20669||Secure Boot Security Feature Bypass Vulnerability||6.7|

47. Security Feature Bypass - Secure Boot (CVE-2024-20688) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-20688||Secure Boot Security Feature Bypass Vulnerability||7.1|

48. Security Feature Bypass - Secure Boot (CVE-2024-20689) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-20689||Secure Boot Security Feature Bypass Vulnerability||7.1|

49. Security Feature Bypass - Secure Boot (CVE-2024-26168) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26168||Secure Boot Security Feature Bypass Vulnerability||6.8|

50. Security Feature Bypass - Secure Boot (CVE-2024-26171) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26171||Secure Boot Security Feature Bypass Vulnerability||6.7|

51. Security Feature Bypass - Secure Boot (CVE-2024-26194) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26194||Secure Boot Security Feature Bypass Vulnerability||7.4|

52. Security Feature Bypass - Secure Boot (CVE-2024-26250) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-26250||Secure Boot Security Feature Bypass Vulnerability||6.7|

53. Security Feature Bypass - Secure Boot (CVE-2024-28897) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28897||Secure Boot Security Feature Bypass Vulnerability||6.8|

54. Security Feature Bypass - Secure Boot (CVE-2024-28903) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

55. Security Feature Bypass - Secure Boot (CVE-2024-28919) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28919||Secure Boot Security Feature Bypass Vulnerability||6.7|

56. Security Feature Bypass - Secure Boot (CVE-2024-28921) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

Tenable: |CVE-2024-28921||Secure Boot Security Feature Bypass Vulnerability||6.7|

57. Security Feature Bypass - Secure Boot (CVE-2024-28924) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-28924||Secure Boot Security Feature Bypass Vulnerability||6.7|

58. Security Feature Bypass - Secure Boot (CVE-2024-29062) - High [478]

Description: Secure Boot Security Feature Bypass Vulnerability

Tenable: |CVE-2024-29062||Secure Boot Security Feature Bypass Vulnerability||7.1|

59. Security Feature Bypass - SmartScreen Prompt (CVE-2024-29988) - High [472]

Description: SmartScreen Prompt Security Feature Bypass Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2024-26256 is a remote code execution vulnerability in libarchive. An attacker requires no authentication to exploit the vulnerability. An unauthorized attacker must wait for a user to initiate a connection for successful exploitation. CVE-2024-26158 is an elevation of privilege vulnerability in the Microsoft Install Service. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26209 is an information disclosure vulnerability in Microsoft Local Security Authority Subsystem Service. On successful exploitation, an attacker may disclose uninitialized memory. CVE-2024-26218 is an elevation of privilege vulnerability in Windows Kernel. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26234 is a spoofing vulnerability in Proxy Driver. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26211 is an elevation of privilege vulnerability in Windows Remote Access Connection Manager. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-26212 is a denial-of-service vulnerability in the DHCP Server Service. Microsoft has not disclosed any information about the vulnerability. CVE-2024-26230 and CVE-2024-26239 are elevation of privilege vulnerabilities in the Windows Telephony Server. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-29056 is an elevation of privilege vulnerability in Windows Authentication. An attacker who successfully exploits the vulnerability may view some sensitive information. The advisory states, “The updates released on or after April 9, 2024, will NOT fully address the security issues in this vulnerability. For more information about how to manage PAC validation changes related to this CVE and the steps you need to take to be fully protected, see How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056.” CVE-2024-29988 is a security feature bypass vulnerability in SmartScreen Prompt. To exploit this vulnerability, an attacker must convince a user to launch malicious files using a launcher application that requests that no UI be shown. CVE-2024-26241 is an elevation of privilege vulnerability in Win32k. On successful exploitation, an attacker could gain SYSTEM privileges. CVE-2024-28921 & CVE-2024-28903 are security feature bypass vulnerabilities in Secure Boot. Successful exploitation of the vulnerability may allow an attacker to bypass Secure Boot. Microsoft mentioned in the advisory, “All customers should apply the April 9, 2024, Windows security updates. These security updates address this vulnerability by updating the Windows Boot Manager and other components, but the protections are not enabled by default. Additional steps are required to mitigate this vulnerability. Please refer to KB5025885.”

Tenable: Microsoft’s April 2024 Patch Tuesday Addresses 147 CVEs (CVE-2024-29988)

Tenable: CVE-2024-29988 | SmartScreen Prompt Security Feature Bypass Vulnerability

Tenable: CVE-2024-29988 is a security feature bypass vulnerability in Microsoft Defender SmartScreen. It was assigned a CVSSv3 score of 8.8 and is rated as important. An attacker could exploit this vulnerability by convincing a target to open a specially crafted file using social engineering tactics such as an external link or malicious attachment sent over email, instant messages or social media.This flaw was reported to Microsoft by some of the same researchers that disclosed CVE-2024-21412, an Internet Shortcut Files security feature bypass that was associated with a DarkGate campaign using fake installer files impersonating Apple iTunes, Notion, NVIDIA and others.

ZDI: CVE-2024-29988 – SmartScreen Prompt Security Feature Bypass Vulnerability. This is an odd one, as a ZDI threat researcher found this vulnerability being in the wild, although Microsoft currently doesn’t list this as exploited. I would treat this as in the wild until Microsoft clarifies. The bug itself acts much like CVE-2024-21412 – it bypasses the Mark of the Web (MotW) feature and allows malware to execute on a target system. Threat actors are sending exploits in a zipped file to evade EDR/NDR detection and then using this bug (and others) to bypass MotW.

60. Information Disclosure - Intel(R) Processor (CVE-2022-0001) - High [470]

Description: Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

61. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28929) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28929||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

62. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28930) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28930||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

63. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28931) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28931||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

64. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28932) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28932||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

65. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28933) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28933||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

66. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28934) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28934||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

67. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28935) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28935||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

68. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28936) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28936||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

69. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28937) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28937||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

70. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28938) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28938||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

71. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28941) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28941||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

72. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-28943) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28943||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

73. Remote Code Execution - Microsoft ODBC Driver for SQL Server (CVE-2024-29043) - High [470]

Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29043||Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability||8.8|

74. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28906) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28906||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

75. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28908) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28908||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

76. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28909) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28909||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

77. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28910) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28910||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

78. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28911) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28911||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

79. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28912) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28912||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

80. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28913) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28913||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

81. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28914) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28914||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

82. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28915) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28915||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

83. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28926) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28926||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

84. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28927) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28927||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

85. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28939) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28939||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

86. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28940) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28940||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

87. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28942) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28942||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

88. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28944) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28944||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

89. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-28945) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-28945||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

90. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29044) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29044||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

91. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29046) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29046||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

92. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29047) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29047||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

93. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29048) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29048||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

94. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29982) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29982||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

95. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29983) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29983||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

96. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29984) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29984||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

97. Remote Code Execution - Microsoft OLE DB Driver for SQL Server (CVE-2024-29985) - High [470]

Description: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-29985||Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability||8.8|

98. Remote Code Execution - Microsoft WDAC OLE DB Provider for SQL Server (CVE-2024-26210) - High [470]

Description: Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-26210||Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability||8.8|

99. Remote Code Execution - Microsoft WDAC OLE DB Provider for SQL Server (CVE-2024-26244) - High [470]

Description: Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability

Tenable: |CVE-2024-26244||Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability||8.8|

100. Remote Code Execution - Microsoft WDAC SQL Server ODBC Driver (CVE-2024-26214) - High [470]

Description: Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability

Tenable: |CVE-2024-26214||Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability||8.8|

101. Elevation of Privilege - Microsoft Defender for IoT (CVE-2024-21324) - High [469]

Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability

102. Elevation of Privilege - Microsoft Defender for IoT (CVE-2024-29054) - High [469]

Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability

103. Elevation of Privilege - Microsoft Defender for IoT (CVE-2024-29055) - High [469]

Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability