CVE-2017-0101

The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted...

CVE-2017-0109

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remo...

CVE-2017-0043

Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Microsoft Active Directory Federation Services...

CVE-2017-0145

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka...

CVE-2017-0045

CVE-2017-0045 is a Windows DVD Maker XML External Entity (XXE) information-disclosure vulnerability affecting Windows 7 SP1, Windows Server 2008 SP2/R2 SP1, and Windows Vista SP2. The vulnerability arises when parsing crafted .msdvd files, enabling an attacker to access local files information on...

CVE-2017-0128

CVE-2017-0128 pertains to a Microsoft Uniscribe information-disclosure vulnerability in Windows fonts handling. The Windows user-mode Uniscribe component (usp10.dll) can be reached via GDI font rendering paths (DrawText) or Language Pack workflows (lpk.dll through user32), allowing an attacker-co...

CVE-2017-0076

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka...

CVE-2017-0116

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Uniscribe Information Disclosure Vulnerability." CVE-2017-0085, CVE-2017-0091, CVE-2017-0092,...

CVE-2017-0148

CVE-2017-0148 is a Microsoft SMBv1 Remote Code Execution vulnerability affecting the SMBv1 server component across multiple Windows versions (Vista SP2; Server 2008 SP2/R2; Windows 7 SP1; Windows 8.1; Server 2012 Gold/R2; Windows RT 8.1; Windows 10 variants; Windows Server 2016). The flaw lets re...

CVE-2017-0005

The Graphics Device Interface GDI in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka “Windows GDI...

CVE-2017-0055

CVE-2017-0055 refers to a cross-site scripting (XSS) elevation-of-privilege vulnerability in Microsoft Internet Information Services (IIS). The issue affects IIS on multiple Windows platforms (Vista through Windows Server 2016) and allows a remote attacker to craft a request that can execute scri...

CVE-2017-0114

CVE-2017-0114 is a Windows Uniscribe (usp10.dll) information-disclosure vulnerability affecting Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1. The issue arises in Uniscribe when processing Unicode text via DrawText paths triggered by user32/lpk, allowing a remote attacker t...

CVE-2017-0108

The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code v...

CVE-2017-0089

CVE-2017-0089 affects Microsoft Windows Uniscribe (USP10) used by the Uniscribe font processing path in user32.dll. The vulnerability arises from a memory corruption in USP10!MergeLigRecords, enabling remote code execution when a user visits a crafted web page. Affected platforms listed in the in...

CVE-2017-0144

CVE-2017-0144 is the SMBv1 Remote Code Execution vulnerability in Windows SMB server (EternalBlue). Connected sources confirm exploitation activity (e.g., DLTMiner/WannaCry-era campaigns) and identification as a high-severity network-based RCE affecting multiple Windows editions. The root cause i...

CVE-2017-0126

CVE-2017-0126 is an Uniscribe (usp10.dll) information-disclosure vulnerability affecting Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1. The issue arises when untrusted or crafted web content triggers Uniscribe code paths via user32’s DrawText flow, enabling a remote attacke...

March 2017 Preview of the Quality Rollup for the .NET Framework 3.5.1, 4.5.2 and 4.6 on Windows 7 and Windows Server 2008 R2 SP1 (KB 3216523): March 21, 2017

March 2017 Preview of the Quality Rollup for the .NET Framework 3.5.1, 4.5.2 and 4.6 on Windows 7 and Windows Server 2008 R2 SP1 KB 3216523: March 21, 2017 Introduction The March 2017 Preview of the Monthly Quality Rollup for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1...

Steam Profile Integration 2.0.11 SQL Injection

Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage: https://invisionpower.com/files/file/8170-steam-profile-integration/ Software Link:...

Microsoft Windows SMB Server Multiple Vulnerabilities (4013389)

This host is missing a critical security update according to Microsoft Bulletin MS17-010WannaCrypt SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (4010320)

This host is missing an important security update according to Microsoft Bulletin MS17-019. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...