KLA11909 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface, obtain sensitive information, bypass security restrictions. Below is a complete list of...

Microsoft Windows - Custom Font Disable Policy Bypass

Microsoft Windows - Custom Font Disable Policy Bypass Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=779 Windows: Custom Font Disable Policy Bypass Platform: Windows 10 Only Class: Security Feature Bypass Summary: It’s possible to bypass the ProcessFontDisablePolicy check in...

CVE-2016-3198

Microsoft Edge allows remote attackers to bypass the Content Security Policy CSP protection mechanism via a crafted document, aka "Microsoft Edge Security Feature Bypass."...

IBM Storwize SSL/TLS RC4 Stream Cipher Key Invariance (Bar Mitzvah)

According to its self-reported version number, the IBM Storwize server running on the remote host is affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A...

Windows Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Graphics Component GDI32.dll fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization ASLR bypass. An attacker who successfully exploited this...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy CSP fails to properly validate certain specially crafted documents. An attacker who exploited the bypass could trick a user into loading a page containing malicious content. To exploit the bypas...

Microsoft Edge Security Feature Bypass (MS16-068: CVE-2016-3198)

A vulnerability was discovered within Mirosoft EDGE that could allw security feature bypass. The vulnerability could allow an attacker to bypass the Content Security Policy CSP...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Security feature bypass

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Security feature bypass

Microsoft Windows 10 Gold and 1511 allows local users to bypass the Virtual Secure Mode Hypervisor Code Integrity HVCI protection mechanism and perform RWX markings of kernel-mode pages via a crafted application, aka "Hypervisor Code Integrity Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Microsoft Windows Virtual Secure Mode Security Feature Bypass vulnerability (3155451)

This host is missing an important security update according to Microsoft Bulletin MS16-066. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows CSRSS Feature Bypass Vulnerability (3148528)

This host is missing an important security update according to Microsoft Bulletin MS16-048 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Security feature bypass

The Client-Server Run-time Subsystem CSRSS in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass...

Windows CSRSS Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Windows when the Client-Server Run-time Subsystem CSRSS fails to properly manage process tokens in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. An attacker could then...

MS16-048: Security Update for CSRSS (3148528)

The remote Windows host is missing a security update. It is, therefore, affected by a security feature bypass vulnerability in the Client-Server Run-time Subsystem CSRSS due to improper management of process tokens in memory. A local attacker can exploit this vulnerability, via a specially crafte...

CVE-2016-0057

Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka "Microsoft Office Security Feature Bypass Vulnerability."...

CVE-2016-0132

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

Microsoft .NET XML Validation Security Feature Bypass Vulnerability (3141780)

This host is missing an important security update according to Microsoft Bulletin MS16-035 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...