28400 matches found
Chromium: CVE-2021-30606 Use after free in Blink
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Media Foundation Information Disclosure Vulnerability
...
Windows Projected File System Elevation of Privilege Vulnerability
...
DirectWrite Remote Code Execution Vulnerability
...
Windows Hyper-V Denial of Service Vulnerability
...
Open Enclave SDK Elevation of Privilege Vulnerability
...
Chromium: CVE-2021-30508 Heap buffer overflow in Media Feeds
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Windows Speech Runtime Elevation of Privilege Vulnerability
...
Windows AppX Deployment Server Denial of Service Vulnerability
...
Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability
...
Windows Media Photo Codec Information Disclosure Vulnerability
...
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
...
Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
...
Azure Sphere Unsigned Code Execution Vulnerability
...
Visual Studio Code ESLint Extension Remote Code Execution Vulnerability
...
Microsoft Windows VMSwitch Denial of Service Vulnerability
...
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
...
Windows Backup Engine Elevation of Privilege Vulnerability
...
Windows Backup Engine Elevation of Privilege Vulnerability
...
Windows Error Reporting Information Disclosure Vulnerability
...
Windows Remote Access Elevation of Privilege Vulnerability
...
Windows WalletService Elevation of Privilege Vulnerability
...
Microsoft Office Online Spoofing Vulnerability
...
Azure Sphere Unsigned Code Execution Vulnerability
...
WebP Image Extensions Information Disclosure Vulnerability
...
Windows - User Profile Service Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows User Profile Service ProfSvc improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first...
Windows Error Reporting Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows Error Reporting WER when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vulnerability could gain greater access to...
Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability
A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...
Microsoft Excel Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with...
Microsoft COM for Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system. To exploit the vulnerability, a user would have to open a specially...
Windows Start-Up Application Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. There are multiple ways an attacker could exploit the vulnerability: In a web-based atta...
Windows Media Audio Decoder Remote Code Execution Vulnerability
A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a...
Windows Runtime Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted...
Windows Kernel Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on ...
Microsoft splwow64 Elevation of Privilege Vulnerability
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. This vulnerability by itself does not allow arbitrary code...
Windows CDP User Components Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows CDP User Components improperly handle memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...
Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability
A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...
Microsoft Word Information Disclosure Vulnerability
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...
Windows Imaging Component Information Disclosure Vulnerability
An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system. There are multiple ways an attacker...
Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system,...
Windows Font Library Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts. For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely. For systems running Windows 10, an attacker who...
Microsoft Office SharePoint XSS Vulnerability
A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...
Connected User Experiences and Telemetry Service Denial of Service Vulnerability
A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who successfully exploited this vulnerability could cause a system to stop responding. To exploit the vulnerability, an attacker would first have to log o...
Microsoft Office SharePoint XSS Vulnerability
A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...
Microsoft Visual Studio Spoofing Vulnerability
A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL. An attacker who successfully exploited this vulnerability could compromise the access tokens, exposing security and privacy risks. To exploit this vulnerability, an attacker would nee...
Windows Network List Service Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could ru...
Diagnostic Hub Standard Collector Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file creation in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a speciall...
Windows Installer Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links. An attacker who successfully exploited this vulnerability could bypass access restrictions to add or remove files. To exploit this vulnerability, an attacker would first have to log o...
Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the...
Microsoft Office Online Spoofing Vulnerability
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly. An attacker could exploit the vulnerability by sending a specially crafted request to an affected site. The attacker who successfully exploited the vulnerability could then perfor...