Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability

CVE-2025-21224 is a high-severity vulnerability affecting Microsoft Windows Server 2022, specifically version 10.0.20348.0. The vulnerability is categorized under CWE-591, which involves sensitive data storage in improperly locked memory, and is linked to the Windows Line Printer Daemon (LPD) service. The LPD service is a network printing protocol that allows remote clients to submit print jobs. This vulnerability allows for remote code execution (RCE) without requiring authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N). Although the attack complexity is high, the impact on confidentiality, integrity, and availability is critical (all rated high). The flaw arises from improper handling of sensitive data in memory, potentially enabling an attacker to execute arbitrary code remotely by exploiting the LPD service. This could lead to full system compromise, data theft, or disruption of printing services. No known exploits are currently reported in the wild, and no patches have been linked yet, increasing the urgency for organizations to monitor updates closely. The vulnerability affects a core Windows Server component, making it a significant risk for environments relying on Windows Server 2022 for print services or other network functions.

Detailed information about CVE-2025-21224: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022 affecting Microsoft Wind

CVE-2025-21224: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-21224: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022

Windows Kernel Elevation of Privilege Vulnerability

CVE-2023-36403 is a medium-severity vulnerability identified in Microsoft Windows 10 Version 1809 (build 10.0.17763.0). It is classified under CWE-591, which pertains to sensitive data storage in improperly locked memory. This vulnerability resides in the Windows kernel, specifically related to how sensitive data is handled in memory regions that are not adequately protected or locked. Improper locking of memory can allow unauthorized processes or users to access sensitive information that should otherwise be protected, potentially leading to privilege escalation. In this context, the vulnerability enables an elevation of privilege attack vector, where a local attacker or malicious process could exploit the flaw to gain higher privileges on the affected system. Although no known exploits are currently observed in the wild, the vulnerability poses a risk because it involves kernel-level memory management, which is critical for system security. The lack of a patch at the time of reporting increases the urgency for organizations to implement compensating controls. The vulnerability was reserved in June 2023 and publicly disclosed in November 2023, indicating a relatively recent discovery. Given that Windows 10 Version 1809 is an older release, the vulnerability primarily affects systems that have not been updated to newer Windows 10 versions or Windows 11. The technical details suggest that the vulnerability arises from improper memory locking mechanisms that fail to prevent unauthorized access to sensitive data stored in kernel memory, which could be leveraged to bypass security boundaries and escalate privileges within the operating system.

Detailed information about CVE-2023-36403: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2023-36403: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-36403: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Windows Telephony Server Elevation of Privilege Vulnerability

CVE-2024-26242 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809 (build 10.0.17763.0). The vulnerability is categorized under CWE-591, which involves sensitive data being stored in improperly locked memory. Specifically, this flaw exists in the Windows Telephony Server component, where sensitive information is not adequately protected in memory, allowing an attacker with limited privileges (low-level privileges) to potentially access or manipulate this data. The vulnerability requires local access (attack vector: local), has a high attack complexity, and does not require user interaction. Exploiting this vulnerability could lead to a complete compromise of confidentiality, integrity, and availability of the affected system, as the attacker can elevate their privileges to a higher level, potentially SYSTEM or administrator. Although no known exploits are currently reported in the wild, the vulnerability's characteristics make it a significant risk, especially in environments where Windows 10 Version 1809 is still in use. The lack of available patches at the time of publication increases exposure. The vulnerability's CVSS 3.1 score is 7.0, reflecting its high severity, with a vector indicating local attack, high complexity, low privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Detailed information about CVE-2024-26242: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2024-26242: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-26242: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Windows Update Stack Elevation of Privilege Vulnerability

CVE-2024-26236 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows Server 2022, specifically the 23H2 Edition with Server Core installation. The vulnerability is categorized under CWE-591, which pertains to sensitive data storage in improperly locked memory. This indicates that sensitive information handled by the Windows Update stack is stored in memory regions that are not adequately protected against unauthorized access. An attacker with low-level privileges (PR:L) and local access (AV:L) but without user interaction (UI:N) can exploit this flaw to escalate their privileges, potentially gaining higher-level access to the system. The vulnerability impacts confidentiality, integrity, and availability (C:H/I:H/A:H), meaning that exploitation could lead to unauthorized disclosure of sensitive data, modification of system components, and disruption of services. The attack complexity is high (AC:H), suggesting that exploitation requires specific conditions or expertise, and no known exploits are currently observed in the wild. The vulnerability affects version 10.0.25398.0 of Windows Server 2022 23H2 Server Core installation, a configuration commonly used in enterprise environments for streamlined server management without a graphical interface. The lack of available patches at the time of publication increases the urgency for organizations to implement interim mitigations and monitor for updates. Given the nature of the vulnerability, it primarily targets the Windows Update mechanism, which is critical for maintaining system security and stability, thus posing a significant risk if exploited.

Detailed information about CVE-2024-26236: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Co

CVE-2024-26236: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-26236: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)

NTFS Elevation of Privilege Vulnerability

CVE-2024-21446 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809 (build 10.0.17763.0). The vulnerability is categorized under CWE-591, which involves sensitive data storage in improperly locked memory. Specifically, this vulnerability relates to the NTFS file system implementation in Windows 10 1809, where sensitive data is stored in memory regions that are not properly locked, potentially allowing unauthorized processes with limited privileges to access or manipulate this data. The flaw can be exploited locally by an attacker with low privileges (PR:L) without requiring user interaction (UI:N). The attack vector is local (AV:L), meaning the attacker must have some form of access to the system, but the vulnerability requires low attack complexity (AC:L). The impact is severe, affecting confidentiality, integrity, and availability (C:H/I:H/A:H), allowing an attacker to elevate privileges, potentially gaining SYSTEM-level access. The vulnerability scope is unchanged (S:U), indicating the impact is confined to the vulnerable component. No known exploits are currently reported in the wild, and no official patches have been linked yet. The vulnerability was reserved in December 2023 and published in March 2024. Given the nature of the vulnerability, it could be leveraged to bypass security controls and gain unauthorized access to sensitive information or system functions, posing a significant risk to affected systems still running Windows 10 Version 1809, which is an older but still in-use version in some environments.

Detailed information about CVE-2024-21446: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2024-21446: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-21446: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2024-21405 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809, specifically targeting the Microsoft Message Queuing (MSMQ) component. The underlying issue is classified under CWE-591, which involves sensitive data being stored in improperly locked memory. This vulnerability allows an attacker with limited privileges (low-level privileges) to potentially escalate their access rights on the affected system. The vulnerability arises because MSMQ does not adequately lock sensitive data in memory, which could be exploited by a local attacker to read or manipulate this data, thereby gaining elevated privileges. The CVSS v3.1 base score is 7.0, reflecting a high severity due to the impact on confidentiality, integrity, and availability, despite the requirement for local access and high attack complexity. No user interaction is required, and the scope is unchanged, meaning the vulnerability affects only the vulnerable component without spreading to other components. Although no known exploits are currently reported in the wild, the presence of this vulnerability in a widely deployed operating system version makes it a significant risk, especially in environments where Windows 10 Version 1809 remains in use. The lack of publicly available patches at the time of publication increases the urgency for mitigation and monitoring.

Detailed information about CVE-2024-21405: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2024-21405: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-21405: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Win32k Elevation of Privilege Vulnerability

CVE-2024-20686 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows Server 2022, specifically the 23H2 Edition with Server Core installation. The vulnerability is classified under CWE-591, which pertains to sensitive data storage in improperly locked memory. This flaw exists within the Win32k subsystem, a core component responsible for graphical device interface and window management in Windows. The vulnerability allows an attacker with limited privileges (low-level privileges) and local access to escalate their privileges to higher levels, potentially SYSTEM level, without requiring user interaction. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring privileges (PR:L) but no user interaction (UI:N). The scope is unchanged (S:U), meaning the vulnerability affects the same security scope. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), indicating that exploitation can lead to full system compromise. Although no known exploits are currently observed in the wild, the vulnerability's nature and impact make it a significant risk for affected systems. The vulnerability arises because sensitive data is stored in memory that is not properly locked, allowing potential unauthorized access or manipulation by malicious processes. This can lead to leakage of sensitive information or enable privilege escalation attacks. The affected version is Windows Server 2022 23H2 (build 10.0.25398.0) Server Core installation, which is commonly used in enterprise environments for server roles requiring minimal GUI overhead. No official patch links have been provided yet, but the vulnerability is publicly disclosed and tracked by Microsoft and CISA.

Detailed information about CVE-2024-20686: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Co

CVE-2024-20686: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-20686: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)

CVE-2024-21355 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809, specifically version 10.0.17763.0. The vulnerability is rooted in Microsoft Message Queuing (MSMQ), a messaging protocol that enables applications running on separate servers/processes to communicate asynchronously. The core issue involves improper locking of sensitive data in memory (CWE-591), which can lead to sensitive information being exposed or manipulated. This improper memory handling allows a low-privileged attacker with local access (as indicated by the CVSS vector AV:L/PR:L) to escalate privileges without requiring user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability, as an attacker could potentially access sensitive data, modify system states, or disrupt services. The attack complexity is high (AC:H), meaning exploitation requires specific conditions or expertise, and no known exploits are currently reported in the wild. The vulnerability does not require user interaction and affects a widely deployed Microsoft OS version, which is still in use in many enterprise environments. The lack of available patches at the time of publication increases the risk for affected systems until remediation is applied.

Detailed information about CVE-2024-21355: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2024-21355: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-21355: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Windows Remote Desktop Services Remote Code Execution Vulnerability

CVE-2024-49132 is a high-severity vulnerability affecting Microsoft Windows 10 Version 1809, specifically version 10.0.17763.0. The vulnerability is categorized under CWE-591, which involves sensitive data storage in improperly locked memory. This flaw exists within the Windows Remote Desktop Services (RDS) component and can lead to remote code execution (RCE). The vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on the target system without user interaction, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N). The attack complexity is high, meaning exploitation requires specific conditions or expertise, but no privileges or user interaction are needed. Successful exploitation impacts confidentiality, integrity, and availability severely (all rated high), potentially allowing full system compromise. The vulnerability arises because sensitive data is stored in memory regions that are not properly locked, making it possible for attackers to access or manipulate this data during RDS sessions. Although no known exploits are currently observed in the wild, the presence of remote code execution capability combined with the lack of authentication requirements makes this a significant threat. The vulnerability was reserved in October 2024 and published in December 2024, with no patches currently linked, indicating that affected systems remain vulnerable until updates are released and applied.

Detailed information about CVE-2024-49132: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 affecting Microsoft 

CVE-2024-49132: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-49132: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows 10 Version 1809

Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

CVE-2024-49128 is a high-severity vulnerability affecting Microsoft Windows Server 2019 (version 10.0.17763.0) specifically within the Windows Remote Desktop Services (RDS) component. The root cause is classified under CWE-591, which involves sensitive data being stored in improperly locked memory. This improper memory handling can lead to unauthorized access to sensitive information. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code over the network without requiring user interaction. The CVSS 3.1 base score of 8.1 reflects the critical nature of the vulnerability, with attack vector being network-based (AV:N), requiring high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), meaning exploitation could lead to full system compromise, data leakage, and service disruption. The vulnerability is currently published but no known exploits in the wild have been reported yet. The lack of available patches at the time of publication increases the urgency for organizations to implement interim mitigations. The vulnerability stems from improper locking of memory regions that hold sensitive data, which could be exploited by attackers to execute code remotely via RDS, a widely used service for remote administration and access in enterprise environments. This makes the vulnerability particularly dangerous in environments where Windows Server 2019 is deployed as a terminal server or for remote management.

Detailed information about CVE-2024-49128: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2019 affecting Microsoft Wind

CVE-2024-49128: CWE-591: Sensitive Data Storage in Improperly Locked Memory in Microsoft Windows Server 2019 - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-591'

Filter Threats

Threats Tagged 'cwe-591'