CVE-2013-1277

AFFECTED: Microsoft Windows family (XP SP2/SP3; Server 2003 SP2; Vista SP2; Server 2008 SP2/R2/R2 SP1; Windows 7 Gold/SP1) – vulnerability in the kernel-mode driver win32k.sys. WHAT: A race condition in win32k.sys that allows local users to gain privileges and read arbitrary kernel memory when a ...

CVE-2011-0029

The CVE-2011-0029 issue affects the Microsoft Remote Desktop Connection client (versions 5.2, 6.0, 6.1, 7.0). It is a local privilege-escalation vulnerability caused by an untrusted search path: a Trojan DLL loaded from the current working directory when a directory contains a .rdp file. Impact i...

CVE-2013-3876

CVE-2013-3876 concerns DirectAccess in Windows platforms where the client/server DirectAccess component fails to properly verify server X.509 certificates. This enables a man-in-the-middle to impersonate a legitimate server and potentially read encrypted domain credentials when a crafted certific...

CVE-2015-0006

The CVE-2015-0006 issue is a vulnerability in Microsoft Windows’ Network Location Awareness (NLA) service. The root cause is that NLA does not perform mutual authentication to verify domain connections, enabling a remote attacker to spoof DNS/LDAP responses on a local network and trigger an unint...

CVE-2010-0489

The CVE-2010-0489 entry corresponds to a Race Condition Memory Corruption vulnerability in Microsoft Internet Explorer (affecting IE 5.01 SP4, 6, 6 SP1, and 7). The connected sources confirm a remote code execution scenario triggered by specially crafted HTML/Web content, with exploitation possib...

CVE-2015-0011

CVE-2015-0011 is a local privilege-escalation flaw in the WebDAV kernel-mode driver mrxdav.sys across multiple Windows OS versions (e.g., Server 2003 SP2, Vista SP2, 2008 SP2/R2, 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1). The root cause is improper enforcement of impersonation protection, all...

CVE-2015-1643

CVE-2015-1643 affects multiple Windows versions (Vista to Server 2012/R2, RT/RT 8.1, etc.). The root cause is NtCreateTransactionManager type confusion that fails to properly constrain impersonation levels, enabling a local unprivileged user to escalate to higher privileges via a crafted applicat...

CVE-2009-0078

CVE-2009-0078 pertains to the Windows WMI Service Isolation Vulnerability in Windows XP SP2/SP3, Server 2003 SP1/SP2, Vista, and Server 2008. The local privilege escalation arises from failure to properly isolate multiple processes running under NetworkService/LocalService accounts, enabling a lo...

CVE-2009-0079

CVE-2009-0079 affects Windows XP (SP2/SP3) and Windows Server 2003 (SP1/SP2). The vulnerability is a failure to isolate multiple RPCSS processes that run under the same account (NetworkService or LocalService), allowing a local user to escalate privileges by accessing resources of sibling RPCSS p...

CVE-2009-2511

CVE-2009-2511 corresponds to a vulnerability in the Windows CryptoAPI: an integer overflow while parsing ASN.1 Object Identifiers (X.509) that can enable spoofing by a certificate issued by a trusted CA. Affected products include Windows 2000 SP4, Windows XP (SP2/SP3), Windows Server 2003 (SP1/SP...

CVE-2009-3674

CVE-2009-3674 affects Microsoft Internet Explorer 8, describing an Uninitialized Memory Corruption vulnerability in how IE8 handles memory objects (uninitialized or deleted) that can enable remote code execution. Multiple records in the connected data corroborate the same memory-corruption vector...

CVE-2010-0027

CVE-2010-0027 documents a vulnerability in URL validation in Internet Explorer (IE 5.01, 6, 6 SP1, 7, 8) and in the ShellExecute API on Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2, where input parameters in crafted URLs could allow remote code execution by an attacker. The connected MSKB en...

CVE-2010-3939

CVE-2010-3939 describes a local privilege-escalation vulnerability in the Windows kernel via the win32k.sys driver. Affected products include Windows XP (SP2/SP3), Windows Server 2003 (SP2), Windows Vista (SP1/SP2), Windows Server 2008 (Gold, SP2, and R2), and Windows 7. The root cause is imprope...

CVE-2011-1967

CVE-2011-1967 affects the Windows Client/Server Run-time Subsystem (CSRSS) via the Winsrv.dll component. The root cause is improper permission checks when a lower‑integrity process sends inter‑process device‑event messages to a higher‑integrity CSRSS, enabling local privilege escalation. Affected...

CVE-2014-1814

CVE-2014-1814 is a local privilege-escalation vulnerability in the Windows Installer service. It affects Windows client/server platforms listed in the advisory (e.g., Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, 7, 8, 8.1, Server 2012/2012 R2, and Windows RT/8.1). The flaw arises from ...

CVE-2015-0080

CVE-2015-0080 affects multiple Windows platforms (Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012) where memory is not properly initialized when rendering certain malformed PNG images, enabling a remote att...

CVE-2015-0088

CVE-2015-0088 is referenced in connected Project Zero posts as an off-by-x out-of-bounds read/write issue related to the Type 2 Charstring/operand stack in ATMFD.DLL/OpenType handling. The supplied connected documents do not provide explicit product versions, root-cause analysis, impact details, ...

CVE-2015-0090

CVE-2015-0090 is a registry-object vulnerability in the Windows ATMFD.DLL font driver. An off‑by‑one bug sanitizing registry indices allows a load/store between the transient array and Registry[3], enabling a read/write‑what‑where primitive. Attackers can spray kernel pools and copy controlled da...

CVE-2015-1716

CVE-2015-1716 is an information-disclosure vulnerability in Schannel (Windows) caused by improper restriction of Diffie-Hellman Ephemeral key lengths. Connected advisories describe it as affecting TLS configurations that permit DHE_EXPORT/weak keys, enabling MITM-style decryption of TLS traffic (...

CVE-2008-1436

The CVE-2008-1436 entry describes a privilege-escalation token kidnapping issue in Windows where improper handling of SeImpersonatePrivilege could allow a context-dependant attacker to gain LocalSystem privileges by coordinating between two service processes. Public details in connected MS bullet...

CVE-2009-0085

CVE-2009-0085 describes a spoofing vulnerability in Microsoft Windows SChannel where the TLS handshake does not adequately validate the client’s key-exchange data when certificate-based authentication is used. A remote attacker with access to the certificate (but not the private key) can authenti...

CVE-2009-1124

This CVE entry covers multiple Windows kernel privilege-escalation flaws (CVE-2009-1123, -1124, -1125, -1126) related to improper validation of changes to kernel objects, user-mode pointers, system-call arguments, and certain desktop parameters. Exploitation is local and requires valid logon cred...

CVE-2010-0025

Technical details for CVE-2010-0025 are not provided in the connected documents; only related DNS spoofing CVEs are present. Monitor for updates.

CVE-2010-0267

CVE-2010-0267 affects Microsoft Internet Explorer 6/6 SP1/7. The issue is remote code execution due to improper handling of memory objects (uninitialized or deleted), causing memory corruption. Multiple connected advisories confirm exploitation vectors via malicious web pages and the potential fo...

CVE-2010-1887

CVE-2010-1887 affects the Windows kernel‑mode driver win32k.sys and is triggered by improper validation of a system call argument, causing a denial of service (system hang) on XP SP2/3, Server 2003 SP2, Vista SP1/SP2, Server 2008 (Gold/SP2/R2), and Windows 7. Connected documents also describe rel...

CVE-2010-3970

CVE-2010-3970 is a stack-based buffer overflow in CreateSizedDIBSECTION within shimgvw.dll (Windows Shell Graphics Processing). It is triggered by a crafted thumbnail bitmap (e.g., via a negative biClrUsed value) and can allow remote code execution. Affected products include Windows XP SP2/SP3, S...

CVE-2011-1284

CVE-2011-1284 is a Windows CSRSS local privilege-escalation vulnerability caused by an integer overflow in the CSRSS SrvWriteConsoleOutput path. Reported root cause: an out-of-bounds/incorrect memory assignment in a user transaction leads to memory corruption and potential kernel-mode code execut...

CVE-2014-1819

CVE-2014-1819 affects Windows kernel-mode font handling (win32k.sys) where access to font-file objects is not properly controlled, enabling local privilege escalation via a crafted font file. Connected docs corroborate font-file handling as the root cause and map to MS14-045 kernel-mode driver up...

CVE-2015-0010

CVE-2015-0010 affects the Windows kernel-mode Cryptography Next Generation driver (cng.sys). The vulnerability occurs when using the CRYPTPROTECTMEMORY_SAME_LOGON option, where the code path does not validate the impersonation token’s level, permitting local users to bypass decryption restriction...

CVE-2015-0094

CVE-2015-0094 is a Windows kernel-mode driver information-disclosure vulnerability where the affected kernel components do not properly restrict address information during a function call, enabling local attackers to bypass ASLR. Affected products include multiple Windows versions listed in sourc...

CVE-2008-2249

The CVE-2008-2249 issue affects multiple Windows client/server editions (2000 SP4, XP SP2/SP3, Server 2003 SP1/SP2, Vista SP1, Server 2008) in the Windows GDI subsystem. It is caused by an integer/buffer overflow in the GDI rendering path when processing a malformed WMF header, leading to remote ...

CVE-2009-0088

CVE-2009-0088 describes a remote code execution vulnerability in the WordPerfect 6.x Converter (WPFT632.CNV) used by Word 2000 SP3 and the Office Converter Pack. The issue arises when the converter fails to properly validate the length of an input string, enabling a crafted WordPerfect 6.x docume...

CVE-2010-0016

CVE-2010-0016 is a remote code execution vulnerability in the SMB client of Microsoft Windows (affected: Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2). The root cause is improper validation of fields in SMB responses by the SMB client, which can allow a crafted SMB response from a malicious ...

CVE-2010-0236

The CVE-2010-0236 entry concerns a Windows kernel memory allocation vulnerability in which memory is not properly allocated for the destination key when extracting a symbolic‑link registry key. A local attacker could exploit this elevation‑of‑privilege flaw to execute code in kernel mode, potenti...

CVE-2010-2743

The CVE-2010-2743 issue affects Windows XP SP3 kernel-mode components, specifically the Win32k NtUserLoadKeyboardLayoutEx path, where indexing of a function-pointer table during loading of keyboard layouts from disk allows a local user to escalate privileges. The underlying cause is improper hand...

CVE-2011-1231

The CVE-2011-1231 issue affects Microsoft Windows kernel-mode drivers, specifically the Win32k.sys component. The vulnerability is a NULL pointer de-reference in Win32k that allows a local attacker to gain privileges on affected systems (Windows XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server ...

CVE-2013-3195

The CVE-2013-3195 vulnerability affects the Windows common control library, specifically the DSA_InsertItem function in Comctl32.dll. It describes an integer/ memory allocation overflow that could allow remote code execution when a crafted value is supplied to an ASP.NET web application, affectin...

CVE-2008-2250

CVE-2008-2250 refers to a Windows kernel elevation-of-privilege vulnerability where the kernel fails to properly validate window properties passed from a parent to a child during new window creation. The issue can allow a local attacker to execute arbitrary code in kernel mode and gain full acces...

CVE-2009-0234

CVE-2009-0234 concerns the DNS Resolver Cache Service (DNSCache) in Windows DNS Server. The vulnerability arises from the DNS server’s handling of crafted DNS responses, where improper caching could let remote attackers predict transaction IDs and poison caches by sending numerous crafted queries...

CVE-2009-1920

The CVE-2009-1920 vulnerability is a remote code execution flaw in the JScript scripting engine (JScript.dll) used by Internet Explorer. It arises from the engine’s handling of decoded scripts loaded into memory, where memory corruption can occur and allow arbitrary code execution when a user vis...

CVE-2011-1984

CVE-2011-1984 affects the Windows WINS service on Windows Server 2003 SP2 and Windows Server 2008 SP2, R2, and R2 SP1. The vulnerability arises from how WINS processes loopback-interface traffic, allowing local attackers to elevate privileges by sending specially crafted packets. Impact is local ...

CVE-2011-1985

CVE-2011-1985 affects the Windows kernel-mode driver win32k.sys. The issue arises from improper validation of user-mode input in Win32k, enabling local users to gain privileges or cause a denial of service via a crafted application, leading to a NULL pointer dereference and system crash. Affected...

CVE-2012-1870

CVE-2012-1870 describes a TLS CBC-mode vulnerability allowing plaintext data disclosure during HTTPS sessions (BEAST-like issue). Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, and Windows 7 SP1. The threat is that an attacker can sniff netwo...

CVE-2013-1285

CVE-2013-1285 concerns Windows USB descriptor handling vulnerabilities in several Windows OS versions (XP SP2/SP3; Server 2003 SP2; Vista SP2; Server 2008 SP2/R2/R2 SP1; Windows 7; Windows 8; Server 2012). The issue arises from improper handling of objects in memory by USB kernel‑mode drivers, en...

CVE-2015-1724

CVE-2015-1724 is a local privilege-escalation use-after-free in Windows kernel-object handling affecting multiple Windows versions (Server 2003 SP2/R2 SP2, Vista SP2, Server 2008 SP2/R2 SP1, 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1). The vulnerability lies in kernel-mode drivers and can be tr...

CVE-2015-1727

CVE-2015-1727 is a local privilege-escalation vulnerability in Windows kernel-mode driver Win32k.sys (buffer overflow). A crafted/local attacker can gain SYSTEM privileges via the Win32k Pool Buffer Overflow vulnerability affecting multiple Windows versions (from Windows Server 2003 SP2/R2 SP2 to...

CVE-2006-4692

CVE-2006-4692 describes an Argument injection in Windows Object Packager (packager.exe) that could allow remote code execution. The vulnerability exists in Windows XP (SP1/SP2) and Windows Server 2003 (SP1 and earlier) due to improper handling of the Command Line property when a slash (/) is incl...

CVE-2009-2506

The CVE-2009-2506 issue is a memory corruption/heap overflow vulnerability in WordPad and Office text converters when parsing the DocumentSummaryInformation stream of a specially crafted Word 97 DOC file. A remote attacker could execute arbitrary code with the privileges of the logged-on user by ...

CVE-2010-0487

CVE-2010-0487 describes a remote code execution vulnerability in Windows Cabinet File Viewer (cabview.dll) where the Authenticode signature verification omits certain fields from the digest for cabinet files. Affected: Cabinet File Viewer Shell Extension (cabview.dll) versions 5.1, 6.0, 6.1 on Wi...

CVE-2010-0488

CVE-2010-0488 relates to an information-disclosure vulnerability in Microsoft Internet Explorer (versions 5.01 SP4, 6, 6 SP1, 7) caused by improper handling of certain encoding strings. The root cause is an issue in how IE processes content with specific encoding strings, allowing a crafted web p...