Microsoft Office Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats. The security feature bypass by itself does not allow arbitrary code execution. However, to successfully exploit the vulnerability, an attacker would have to use it i...

Secure Boot Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Windows Secure Boot improperly applies an affected policy. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, ...

Windows File System Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the Windows kernel that could allow an attacker to exploit time of check time of use TOCTOU issues in file path-based checks from a low-integrity application. An attacker who successfully exploited this vulnerability could potentially modify files...

Internet Explorer Security Feature Bypass Vulnerability

A restricted ports security feature bypass vulnerability exists for Internet Explorer. An attacker could take advantage of the vulnerability to trick a user into connecting to a remote system. To exploit the vulnerability, an attacker would have to either convince a user to visit a malicious...

KLA11909 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface, obtain sensitive information, bypass security restrictions. Below is a complete list of...

Microsoft Windows - Custom Font Disable Policy Bypass

Microsoft Windows - Custom Font Disable Policy Bypass Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=779 Windows: Custom Font Disable Policy Bypass Platform: Windows 10 Only Class: Security Feature Bypass Summary: It’s possible to bypass the ProcessFontDisablePolicy check in...

CVE-2016-3198

Microsoft Edge allows remote attackers to bypass the Content Security Policy CSP protection mechanism via a crafted document, aka "Microsoft Edge Security Feature Bypass."...

IBM Storwize SSL/TLS RC4 Stream Cipher Key Invariance (Bar Mitzvah)

According to its self-reported version number, the IBM Storwize server running on the remote host is affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase. A...

Windows Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Graphics Component GDI32.dll fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization ASLR bypass. An attacker who successfully exploited this...

Microsoft Edge Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy CSP fails to properly validate certain specially crafted documents. An attacker who exploited the bypass could trick a user into loading a page containing malicious content. To exploit the bypas...

Microsoft Edge Security Feature Bypass (MS16-068: CVE-2016-3198)

A vulnerability was discovered within Mirosoft EDGE that could allw security feature bypass. The vulnerability could allow an attacker to bypass the Content Security Policy CSP...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Security feature bypass

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Security feature bypass

Microsoft Windows 10 Gold and 1511 allows local users to bypass the Virtual Secure Mode Hypervisor Code Integrity HVCI protection mechanism and perform RWX markings of kernel-mode pages via a crafted application, aka "Hypervisor Code Integrity Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Microsoft Windows Virtual Secure Mode Security Feature Bypass vulnerability (3155451)

This host is missing an important security update according to Microsoft Bulletin MS16-066. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Security feature bypass

The Client-Server Run-time Subsystem CSRSS in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass...

Windows CSRSS Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in Microsoft Windows when the Client-Server Run-time Subsystem CSRSS fails to properly manage process tokens in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. An attacker could then...

MS16-048: Security Update for CSRSS (3148528)

The remote Windows host is missing a security update. It is, therefore, affected by a security feature bypass vulnerability in the Client-Server Run-time Subsystem CSRSS due to improper management of process tokens in memory. A local attacker can exploit this vulnerability, via a specially crafte...