2045 matches found
CVE-2025-21247
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
CVE-2025-26633
CVE-2025-26633 is a local-privilege-escalation in Microsoft Management Console (MMC) caused by improper neutralization in how MMC loads language-twin .msc files. A malicious “evil twin” .msc in a language directory can execute payloads with the user’s privileges when a user opens a legitimate MMC...
CVE-2025-26630
CVE-2025-26630 is a use-after-free vulnerability in Microsoft Office Access that can allow a local attacker to execute arbitrary code. The issue affects Microsoft Access/Office components and is rated CVSS v3.1 base score 7.8 (High) with Local attack vector, Privileges None, User Interaction requ...
CVE-2025-24049
Azure CLI Core on SUSE SLES12/15 (and openSUSE) Vulnerability: CVE-2025-24049 – Improper neutralization of special elements used in a command (command injection) in Azure CLI integration could allow a local attacker to elevate privileges. Affected components: azure-cli-core packages on SUSE SLES1...
CVE-2025-24993
CVE-2025-24993 is a Windows NTFS heap-based buffer overflow that allows a locally authenticated attacker to execute arbitrary code. Affected component is NTFS on Windows; root cause is a heap-based overflow in NTFS handling. CVSS v3.1 indicates local attack vector, no privileges required, user in...
CVE-2025-24054
CVE-2025-24054 is a Windows NTLM vulnerability allowing an attacker to induce NTLMv2-SSP hash disclosure by leveraging explorer.exe to fetch remote SMB resources via crafted file types (notably .library-ms and .lnk/.library-ms payloads). Public PoCs and exploits demonstrate creating malicious .li...
CVE-2025-21199
Azure Agent Installer for Backup and Site Recovery is affected by CVE-2025-21199 due to improper privilege management, allowing an authorized attacker to elevate privileges locally. The issue targets the Azure Agent Installer component used for disaster recovery, with a CVSSv3.1 base score of 6.7...
CVE-2025-24996
CVE-2025-24996 : Affects Windows NTLM. External control of a file name or path enables an unauthorized network spoofing scenario, potentially allowing impersonation over a network. CVSSv3.1 base 6.5 (Network attack, low complexity, no privileges required, user interaction required; CIA: high conf...
CVE-2025-21180
CVE-2025-21180 is a Windows exFAT File System vulnerability described as a heap-based buffer overflow that could allow local code execution. The connected documents identify the affected component as the Windows exFAT file system driver and confirm the root cause as a heap-based overflow, enablin...
CVE-2025-24082
CVE-2025-24082 is a Microsoft Excel remote code execution vulnerability described as a use-after-free in Excel that can allow a local attacker to run arbitrary code. The CVE is confirmed by Microsoft’s MSRC entry (Microsoft Excel Remote Code Execution Vulnerability) and is referenced alongside re...
CVE-2025-24079
CVE-2025-24079 is a use-after-free vulnerability in Microsoft Word (Office) that allows a local attacker to execute code on a vulnerable system. The issue affects Word components and is triggered by a crafted input/application behavior, with CVSS 3.1 scoring a base 7.8 (High) and an attack vector...
CVE-2025-24077
CVE-2025-24077 is a Microsoft Word use-after-free vulnerability that enables a local attacker to execute code on affected systems. The weakness resides in Word/Office components and, per the sources, can lead to arbitrary code execution with high impact (CVE-2025-24077). Affected products include...
CVE-2025-1434
CVE-2025-1434 describes an XSS vulnerability in the Spreadsheet view of Areal Topkapi Vision Webserv2. The weakness allows a remote, unauthenticated attacker to read a limited amount of values or perform a denial-of-service (DoS) on the affected spreadsheet. Disclosure of secrets or other system ...
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally...
MapUrlToZone Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...
Microsoft Management Console Security Feature Bypass Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...