Vulnerability landscape analysis for Q4 2024
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel | 7.8 | 93% | KEVPoC ×4 | KEV |
| CVE-2022-34918 | An issue was discovered in the Linux kernel through 5.18.9 | 7.8 | 5% | PoC ×4 | |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion | 7.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2024-0582 | A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and… | 7.8 | 13% | ||
| CVE-2024-1086 | Use-After-Free Local Privilege Escalation in Linux Kernel nf_tables | 7.8 | 28% | KEVRansomwarePoC ×4 | KEV |
| CVE-2024-21447 | Windows Authentication Elevation of Privilege Vulnerability | 7.8 | 1% | ||
| CVE-2024-28916 | Xbox Gaming Services Elevation of Privilege Vulnerability | 8.8 | <1% | ||
| CVE-2024-38100 | Windows File Explorer Elevation of Privilege Vulnerability | 7.8 | 5% |
From the original article
8 min read at securelist.com
Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept (PoC) instances decreased compared to 2023. Among notable techniques in Q4, attackers leveraged undocumented RPC interfaces and targeted the Windows authentication mechanism.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.