Threat intelligence
MICROSOFT SECURITY BULLETIN COVERAGE FOR MAY 2024
Overview
Microsoft’s May 2024 Patch Tuesday has 59 vulnerabilities, 25 of which are Remote Code Execution vulnerabilities. The SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of May 2024 and has produced coverage for 9 of the reported vulnerabilities.
Vulnerabilities with Detections
| CVE | CVE Title | Signature |
| CVE-2024-29996 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ASPY 568 Exploit-exe exe.MP_383 |
| CVE-2024-30025 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ASPY 569 Exploit-exe exe.MP_384 |
| CVE-2024-30032 | Windows DWM Core Library Elevation of Privilege Vulnerability | ASPY 570 Exploit-exe exe.MP_385 |
| CVE-2024-30034 | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability | ASPY 571 Exploit-exe exe.MP_386 |
| CVE-2024-30035 | Windows DWM Core Library Elevation of Privilege Vulnerability | ASPY 572 Exploit-exe exe.MP_387 |
| CVE-2024-30037 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | ASPY 567 Exploit-exe exe.MP_382 |
| CVE-2024-30044 | Microsoft SharePoint Server Remote Code Execution Vulnerability | IPS 15674 Microsoft SharePoint Server Remote Code Execution (CVE-2024-30044) |
| CVE-2024-30050 | Windows Mark of the Web Security Feature Bypass Vulnerability | IPS 15666 Windows Mark of the Web Security Feature Bypass (CVE-2024-30050) |
| CVE-2024-30051 | Windows DWM Core Library Elevation of Privilege Vulnerability | ASPY 566 Malformed-docx docx.MP_11 |
Release Breakdown
The vulnerabilities can be classified into the following categories:
For May, there are 57 critical, 1 Important, and 1 moderate vulnerabilities.
2024 Patch Tuesday Monthly Comparison
Microsoft tracks vulnerabilities that are being actively exploited at the time of discovery and those that have been disclosed publicly before the patch Tuesday release for each month. The above chart displays these metrics as seen each month.
Release Detailed Breakdown
Denial of Service Vulnerabilities
| CVE-2024-30011 | Windows Hyper-V Denial of Service Vulnerability |
| CVE-2024-30019 | DHCP Server Service Denial of Service Vulnerability |
| CVE-2024-30046 | ASP.NET Core Denial of Service Vulnerability |
Elevation of Privilege Vulnerabilities
| CVE-2024-26238 | Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability |
| CVE-2024-29994 | Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability |
| CVE-2024-29996 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2024-30007 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
| CVE-2024-30018 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2024-30025 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2024-30027 | NTFS Elevation of Privilege Vulnerability |
| CVE-2024-30028 | Win32k Elevation of Privilege Vulnerability |
| CVE-2024-30030 | Win32k Elevation of Privilege Vulnerability |
| CVE-2024-30031 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability |
| CVE-2024-30032 | Windows DWM Core Library Elevation of Privilege Vulnerability |
| CVE-2024-30033 | Windows Search Service Elevation of Privilege Vulnerability |
| CVE-2024-30035 | Windows DWM Core Library Elevation of Privilege Vulnerability |
| CVE-2024-30037 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2024-30038 | Win32k Elevation of Privilege Vulnerability |
| CVE-2024-30049 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
| CVE-2024-30051 | Windows DWM Core Library Elevation of Privilege Vulnerability |
Information Disclosure Vulnerabilities
| CVE-2024-30008 | Windows DWM Core Library Information Disclosure Vulnerability |
| CVE-2024-30016 | Windows Cryptographic Services Information Disclosure Vulnerability |
| CVE-2024-30034 | Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability |
| CVE-2024-30036 | Windows Deployment Services Information Disclosure Vulnerability |
| CVE-2024-30039 | Windows Remote Access Connection Manager Information Disclosure Vulnerability |
| CVE-2024-30043 | Microsoft SharePoint Server Information Disclosure Vulnerability |
| CVE-2024-30054 | Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability |
Remote Code Execution Vulnerabilities
| CVE-2024-29997 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-29998 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-29999 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30000 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30001 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30002 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30003 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30004 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30005 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30006 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-30009 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30010 | Windows Hyper-V Remote Code Execution Vulnerability |
| CVE-2024-30012 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30014 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30015 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30017 | Windows Hyper-V Remote Code Execution Vulnerability |
| CVE-2024-30020 | Windows Cryptographic Services Remote Code Execution Vulnerability |
| CVE-2024-30021 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2024-30022 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30023 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30024 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30029 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-30042 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2024-30044 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2024-30045 | .NET and Visual Studio Remote Code Execution Vulnerability |
Security Feature Bypass Vulnerabilities
| CVE-2024-30040 | Windows MSHTML Platform Security Feature Bypass Vulnerability |
| CVE-2024-30050 | Windows Mark of the Web Security Feature Bypass Vulnerability |
Spoofing Vulnerabilities
| CVE-2024-30041 | Microsoft Bing Search Spoofing Vulnerability |
| CVE-2024-30047 | Dynamics 365 Customer Insights Spoofing Vulnerability |
| CVE-2024-30048 | Dynamics 365 Customer Insights Spoofing Vulnerability |
| CVE-2024-30053 | Azure Migrate Cross-Site Scripting Vulnerability |
Tampering Vulnerabilities
| CVE-2024-30059 | Microsoft Intune for Android Mobile Application Management Tampering Vulnerability |
Share This Article
An Article By
An Article By
Security News
Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.
