CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-8012 – Ivanti Workspace Control RES Exposed Dangerous Method Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-8012
An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.2EPSS: 15%CPEs: -EXPL: 1CVE-2024-8190 – Ivanti Cloud Services Appliance OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-8190
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. • https://github.com/horizon3ai/CVE-2024-8190 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 1CVE-2024-8504 – VICIdial Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-8504
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective. An attacker with authenticated access to VICIdial version 2.14-917a as an agent can execute arbitrary shell commands as the root user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective. • https://github.com/Chocapikk/CVE-2024-8504 https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt https://www.vicidial.org/vicidial.php • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-43495 – Windows libarchive Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-43495
Windows libarchive Remote Code Execution Vulnerability • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43495 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-43491 – Microsoft Windows Update Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2024-43491
Microsoft Windows Update contains a use-after-free vulnerability that allows for remote code execution. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43491 • CWE-416: Use After Free •