CVE-2024-43511 is a Windows Kernel elevation of privilege vulnerability affecting multiple builds of Windows 10 Version 1507 and later. It is a time-of-check to time-of-use (TOCTOU) race condition that could allow an attacker with low privileges to gain higher privileges on the system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available in specific Windows 10 builds.
Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
CVE-2023-33119 is a high-severity TOCTOU race condition vulnerability in Qualcomm Snapdragon platforms that leads to memory corruption when loading a VM from a signed VM image that is not coherent in the processor cache. It affects a wide range of Snapdragon SoCs and related products, potentially compromising confidentiality, integrity, and availability without requiring user interaction or privileges. The vulnerability arises from a time-of-check to time-of-use flaw (CWE-367) where cache incoherency allows an attacker to manipulate VM images during loading. Although no known exploits are reported in the wild yet, the broad product impact and high CVSS score (8.4) make it a critical concern for devices using affected Snapdragon components. European organizations relying on mobile, IoT, automotive, or edge computing devices with these chipsets could face risks of device compromise or data breaches. Mitigation requires applying vendor patches once available, ensuring secure VM image handling, and monitoring for suspicious activity related to VM loading processes. Countries with high adoption of Snapdragon-based devices, such as Germany, France, UK, and Nordic states, are most likely to be impacted due to market penetration and strategic use of affected platforms.
CVE-2023-35311 is a high-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Microsoft 365 Apps for Enterprise, specifically affecting Microsoft Outlook. This flaw allows an attacker to bypass security features, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The vulnerability requires no privileges but does require user interaction, and it can be exploited remotely over the network. Although no known exploits are currently in the wild, the high CVSS score of 8.8 indicates a significant risk. European organizations using Microsoft 365 Apps for Enterprise version 16.0.1 are at risk, especially those with large deployments of Outlook. Mitigation involves applying patches once available, restricting user interaction with untrusted content, and monitoring for suspicious activity. Countries with high Microsoft 365 adoption and strategic targets, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between the scripts being discovered and them being run. An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with ones that are not.
