CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2021-24096 – Windows Kernel Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2021-24096
Windows Kernel Elevation of Privilege Vulnerability Una Vulnerabilidad de Elevación de Privilegios del kernel de Windows Microsoft Windows has a privilege escalation vulnerability. When a process is running in a server silo, the checks for trusted hive registry key symbolic links is disabled leading to elevation of privilege. • https://github.com/FunPhishing/CVE-2021-24096 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24096 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2021-24081 – Microsoft Windows Codecs Library Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-24081
Microsoft Windows Codecs Library Remote Code Execution Vulnerability Una Vulnerabilidad de Ejecución de Código Remota de Windows Codecs Library de Microsoft This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the camera codec pack library. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24081 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 0CVE-2021-24083 – Windows Address Book Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-24083
Windows Address Book Remote Code Execution Vulnerability Una Vulnerabilidad de Ejecución de Código Remota de Windows Address Book This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WAB files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of current process. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24083 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 12EXPL: 1CVE-2021-24091 – Windows Camera Codec Pack Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-24091
Windows Camera Codec Pack Remote Code Execution Vulnerability Una Vulnerabilidad de Ejecución de Código Remota de Camera Codec Pack de Windows This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WindowsCodecsRaw module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. There is an out-of-bounds write vulnerability in WindowsCodecsRaw.dll in the COlympusE300LoadRaw::olympus_e300_load_raw function that can be triggered by parsing a crafted Olympus E300 raw image with Windows Imaging Component (WIC). • http://packetstormsecurity.com/files/161713/Microsoft-Windows-WindowsCodecsRaw-COlympusE300LoadRaw-Out-Of-Bounds-Write.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24091 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 1CVE-2021-24084 – Windows Mobile Device Management Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-24084
Windows Mobile Device Management Information Disclosure Vulnerability Una Vulnerabilidad de Divulgación de Información de Mobile Device Management de Windows This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Device Management Enrollment Service. By creating a directory junction, an attacker can abuse the Device Management Enrollment Service to disclose the contents of arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. • https://github.com/Jeromeyoung/CVE-2021-24084 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24084 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •