Severity
High
Analysis Summary
CVE-2024-38238 CVSS:7.8
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Kernel Streaming Service Driver component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.
CVE-2024-38018 CVSS:8.8
Microsoft SharePoint Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an error within the handling of serialized instances of the SPThemes class. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-38227 CVSS:7.2
Microsoft SharePoint Server could allow a remote authenticated attacker to execute arbitrary code on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-38223 CVSS:7.5
Microsoft Windows is vulnerable to a denial of service, caused by a flaw in the Networking component. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-43474 CVSS:7.6
Microsoft SQL Server could allow a remote authenticated attacker to obtain sensitive information. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.
CVE-2024-38252 CVSS:7.8
Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32 Kernel Subsystem component. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.
CVE-2024-37338 CVSS:8.8
Microsoft SQL Server could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-37340 CVSS:8.8
Microsoft SQL Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Native Scoring component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-37342 CVSS:7.1
Microsoft SQL Server could allow a remote authenticated attacker to obtain sensitive information caused by a flaw in Native Scoring component. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.
CVE-2024-37339 CVSS:8.8
Microsoft SQL Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Native Scoring component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-43461 CVSS:8.8
Microsoft Windows could allow a remote attacker to conduct spoofing attacks.
CVE-2024-38119 CVSS:7.5
Microsoft Windows could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Network Address Translation (NAT component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-38258 CVSS:6.5
Microsoft Windows could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the Remote Desktop Licensing Service component. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and then use this information to launch further attacks against the affected system.
CVE-2024-38260 CVSS:8.8
Microsoft Windows could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Remote Desktop Licensing Service component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-37335 CVSS:8.8
Microsoft SQL Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in the Native Scoring component. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Impact
- Denial of Service
- Gain Access
- Code Execution
- Privilege Escalation
- Information Disclosure
Indicators of Compromise
CVE
- CVE-2024-38238
- CVE-2024-38018
- CVE-2024-38227
- CVE-2024-38223
- CVE-2024-43474
- CVE-2024-38252
- CVE-2024-37338
- CVE-2024-37340
- CVE-2024-37342
- CVE-2024-37339
- CVE-2024-43461
- CVE-2024-38119
- CVE-2024-38258
- CVE-2024-38260
- CVE-2024-37335
Affected Vendors
Affected Products
- Microsoft SharePoint Enterprise Server 2016
- Microsoft Windows Server 2022
- Microsoft ODBC Driver 17 for SQL Server
- Microsoft Windows 10 Version 1607 - 10.0.0
- Microsoft Windows 10 Version 1607 for 32-bit Systems - 1607
- Microsoft Windows 10 Version 1809 - 10.0.0
- Microsoft Windows Server 2016 - 10.0.0
- Microsoft Windows Server 2019 - 10.0.0
- Microsoft Windows Server 2019 (Server Core installation) - 10.0.0
- Microsoft Windows Server 2022 - 10.0.0
- Microsoft SQL Server 2017 (GDR) - 14.0.0
- Microsoft SQL Server 2019 (GDR) - 15.0.0
- Microsoft Windows Server 2016 (Server Core installation) - 10.0.0
- Microsoft SharePoint Enterprise Server 2016 - 16.0.0
- Microsoft SharePoint Server 2019 - 16.0.0
- Microsoft SharePoint Server Subscription Edition - 16.0.0
- Microsoft SQL Server 2017 (CU 31) - 14.0.0
- Microsoft SQL Server 2022 (GDR) - 16.0.0
Remediation
Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.