CVE-2024-23764

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.withsecure.com/en/support/security-advisoriesProduct
https://www.withsecure.com/en/support/security-advisories/cve-2024-23764Vendor Advisory
https://www.withsecure.com/en/support/security-advisoriesProduct
https://www.withsecure.com/en/support/security-advisories/cve-2024-23764Vendor Advisory

Timeline

Published: Feb 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-237654.0An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes an unidentified service on port 7412 on the network.CVE-2024-237667.5An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET r CVE-2024-237678.8An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's CVE-2024-237688.8Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in th CVE-2024-237695.5Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged CVE-2024-23777.6A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this CVE-2024-237705.5darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.CVE-2024-237719.8darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypas CVE-2024-237726.6An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedul CVE-2024-237737.8An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedul CVE-2024-237747.8An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the K CVE-2024-237757.5Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via m