CWE-908 vulnerabilities

Windows COM Server Information Disclosure Vulnerability

CVE-2024-12085 is a vulnerability in rsync where an attacker can manipulate the checksum length during file checksum comparison. This causes rsync to compare a checksum against uninitialized stack memory, potentially leaking one byte of uninitialized stack data at a time. The flaw has a high severity with a CVSS score of 7.5. A fix is available in updated Red Hat Enterprise Linux 10 packages.

An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.

CVE-2024-43537 is a vulnerability in the Windows Mobile Broadband Driver affecting multiple builds of Microsoft Windows 10 Version 1809 and later. It involves the use of an uninitialized resource, leading to a denial of service condition. The issue has been officially fixed in specific Windows 10 builds. The vulnerability has a medium severity rating with a CVSS score of 6.5 and does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild.

CVE-2024-43502 is a Windows Kernel elevation of privilege vulnerability affecting Windows 10 Version 1809 and certain later builds. It involves the use of an uninitialized resource, which can lead to privilege escalation. The vulnerability has been assigned a high severity with a CVSS score of 7.1. Microsoft has released official fixes for the affected versions.

Windows Networking Information Disclosure Vulnerability

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Microsoft AllJoyn API Information Disclosure Vulnerability

Windows Kernel-Mode Driver Information Disclosure Vulnerability

Windows Authentication Information Disclosure Vulnerability

CVE-2024-8178 is a critical vulnerability in FreeBSD where the ctl_write_buffer and ctl_read_buffer functions allocate memory without initializing it. This flaw can be exploited by malicious software running in a guest VM exposing virtio_scsi to execute code on the host's bhyve userspace process, which runs with root privileges but within a Capsicum sandbox. Additionally, a malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. The vulnerability affects FreeBSD versions 13.3-RELEASE, 14.0-RELEASE, and 14.1-RELEASE.

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being used in succeeding validation steps. By uploading specially crafted network configuration, an authenticated remote attacker could be able to inject commands that are executed on the device with root privileges during device startup.

Windows Kernel Information Disclosure Vulnerability