CVE-2024-1244
published 2025-06-11CVE-2024-1244: Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession…
PriorityP258critical9.5CVSS 4.0
AVNACHATPPRNUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
21.3th percentile
Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | emacs | >= 0 < 1:26.3+1-1ubuntu2+esm2 | 1:26.3+1-1ubuntu2+esm2 |
| gnu | emacs | >= 0 < 1:27.1+1-3ubuntu5.2+esm1 | 1:27.1+1-3ubuntu5.2+esm1 |
| gnu | emacs | >= 0 < 1:29.3+1-1ubuntu2+esm3 | 1:29.3+1-1ubuntu2+esm3 |
| ossec | ossec-hids_agent | — | — |
CVSS provenance
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
emacs vulnerabilities
osv·2026-02-04·CVSS 7.8
CVE-2024-53920 emacs vulnerabilities
emacs vulnerabilities
It was discovered that Emacs could trigger unsafe Lisp macro expansion,
when a user invoked elisp-completion-at-point on untrusted Emacs Lisp
source code. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-53920)
It was discovered that Emacs did not properly sanitize input when
handling certain URI schemes. An attacker could possibly use this issue
to execute arbitrary shell commands by tricking a user into opening a
specially crafted URL. (CVE-2025-1244)
GHSA
GHSA-4979-ffcq-3f48: Improper input validation in the OSSEC HIDS agent for Windows prior to version 3
ghsa_unreviewed·2025-06-11
CVE-2024-1244 [CRITICAL] CWE-20 GHSA-4979-ffcq-3f48: Improper input validation in the OSSEC HIDS agent for Windows prior to version 3
Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-11
Published