CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-26507
https://notcve.org/view.php?id=CVE-2024-26507
An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit v.7.00.6700 and before allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMdlForNonPagedPool, or MmMapLockedPages components. • https://belong2yourself.github.io/vulnerabilities/docs/AIDA/Elevation-of-Privileges/readme • CWE-1286: Improper Validation of Syntactic Correctness of Input •
CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-34332
https://notcve.org/view.php?id=CVE-2024-34332
An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent to the Kernel Driver using the DeviceIoControl Windows API. • https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7261 – Google Chrome Updater DosDevices Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-7261
(Severidad de seguridad de Chrome: alta) This vulnerability allows local attackers to escalate privileges on affected installations of Google Chrome. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://issues.chromium.org/issues/40064602 • CWE-233: Improper Handling of Parameters •
CVSS: 8.1EPSS: 0%CPEs: -EXPL: 0CVE-2024-3150 – Privilege Escalation in mintplex-labs/anything-llm
https://notcve.org/view.php?id=CVE-2024-3150
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. ... Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system. • https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc https://huntr.com/bounties/745f5c80-14ea-4055-9f15-a066ae93e5a3 • CWE-20: Improper Input Validation •
CVSS: 7.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-3110 – Stored XSS leading to admin account takeover in mintplex-labs/anything-llm
https://notcve.org/view.php?id=CVE-2024-3110
The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. • https://github.com/mintplex-labs/anything-llm/commit/49f30e051c9f6e28977d57d0e5f49c1294094e41 https://huntr.com/bounties/c2895978-364d-412d-8825-c806606bcb85 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •