Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2024-49138 — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
|
Microsoft | Windows | Dec 10, 2024 | Dec 31, 2024 | |
|
CVE-2024-43451 — Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
|
Microsoft | Windows | Nov 12, 2024 | Dec 3, 2024 | |
|
CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
|
Microsoft | Windows | Nov 12, 2024 | Dec 3, 2024 | Ransomware |
|
CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
|
Microsoft | SharePoint | Oct 22, 2024 | Nov 12, 2024 | Ransomware |
|
CVE-2024-30088 — Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
|
Microsoft | Windows | Oct 15, 2024 | Nov 5, 2024 | Ransomware |
|
CVE-2024-43572 — Microsoft Windows Management Console Remote Code Execution Vulnerability
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
|
Microsoft | Windows | Oct 8, 2024 | Oct 29, 2024 | |
|
CVE-2024-43573 — Microsoft Windows MSHTML Platform Spoofing Vulnerability
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
|
Microsoft | Windows | Oct 8, 2024 | Oct 29, 2024 | |
|
CVE-2020-0618 — Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
|
Microsoft | SQL Server | Sep 18, 2024 | Oct 9, 2024 | Ransomware |
|
CVE-2024-43461 — Microsoft Windows MSHTML Platform Spoofing Vulnerability
Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.
|
Microsoft | Windows | Sep 16, 2024 | Oct 7, 2024 | |
|
CVE-2024-38014 — Microsoft Windows Installer Improper Privilege Management Vulnerability
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
|
Microsoft | Windows | Sep 10, 2024 | Oct 1, 2024 |
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
Windows · Dec 10, 2024
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Windows · Nov 12, 2024
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
Windows · Nov 12, 2024
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
SharePoint · Oct 22, 2024
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
Windows · Oct 15, 2024
Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Windows · Oct 8, 2024
Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
Windows · Oct 8, 2024
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.
SQL Server · Sep 18, 2024
Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.
Windows · Sep 16, 2024
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
Windows · Sep 10, 2024