CVE-2024-38068

Technical details about CVE-2024-38068 are not provided in the supplied documents. No affected products, root cause, impact, or remediation are described here; monitor for updates from official advisories.

CVE-2024-43517

CVE-2024-43517 is a Microsoft ActiveX Data Objects Remote Code Execution vulnerability. Documented details indicate an in-the-wild risk with network access (AV:N) and user interaction required (UI:R), with a high impact on confidentiality, integrity, and availability (C/I/A: High) and a base scor...

CVE-2024-49127

CVE-2024-49127 is a Windows LDAP Remote Code Execution vulnerability in the LDAP component of Domain Controllers. The CVSS shows high impact (C/H, I/H, A/H) with network access required and no user interaction. The exploitation path involves an attacker obtaining network access to the DC and issu...

CVE-2025-21328

CVE-2025-21328 maps to a Windows MapUrlToZone security feature bypass vulnerability. Connected docs confirm affected component and root cause: bypassing security checks in MapUrlToZone, enabling circumvention of security measures. CVSS v3.1 base metrics shown as 4.3 (MEDIUM) with Network attack v...

CVE-2011-3417

The CVE-2011-3417 entry concerns the ASP.NET Forms Authentication feature in Microsoft .NET Framework (1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, 4.0). When sliding expiry is enabled, cached content is not handled properly, allowing remote attackers to access arbitrary user accounts via a crafted URL (For...

CVE-2016-3371

CVE-2016-3371 is a Windows kernel elevation of privilege vulnerability affecting a broad set of Windows versions (Vista SP2/2008 SP2 R2, Windows 7 SP1, 8.1, Server 2012/RT, Windows 10 1511/1607). The issue stems from improper enforcement of permissions by the Windows Kernel API, allowing local at...

CVE-2017-0166

CVE-2017-0166: An LDAP elevation of privilege vulnerability in Windows occurs when LDAP request buffer lengths are improperly calculated. This enables a remote attacker to send malicious traffic to a Domain Controller to achieve elevated privileges. The initial description and connected documents...

CVE-2017-0268

CVE-2017-0268 is an SMBv1 information-disclosure vulnerability in Microsoft Windows SMB Server handling of certain requests. Connected entries corroborate an SMBv1 information-disclosure issue affecting Windows SMB Server and reference published advisories and mitigations. IBM API Connect advisor...

CVE-2017-0280

CVE-2017-0280 is a remote-denial-of-service vulnerability in the Microsoft Windows SMB Server (SMBv1). The issue occurs when the SMBv1 server processes crafted SMB requests, allowing an unauthenticated attacker to trigger a DoS condition on the target system. Documents reference the vulnerability...

CVE-2017-0284

CVE-2017-0284 is an information-disclosure vulnerability in Windows Uniscribe that can disclose memory contents. It affects Windows and Office components (notably Uniscribe) across multiple OS releases (Windows 7/8.1/10, Windows Server variants, Office 2007/2010). The root cause is improper discl...

CVE-2017-8577

Technical details for CVE-2017-8577 are not provided in the supplied documents; no explicit affected product/version, root cause, impact, or fix is disclosed here. Monitor for updates.

CVE-2017-8589

CVE-2017-8589 is a Windows Search Remote Code Execution vulnerability affecting Windows 7 SP1, Windows Server 2008 SP2/R2 SP1, Windows 8.1/RT 8.1, Windows Server 2012/R2, Windows 10 (gold and 1511–1703) and Windows Server 2016. The root cause is the way Windows Search handles objects in memory, e...

CVE-2018-17612

Summary of CVE-2018-17612 : Sennheiser HeadSetup (and HeadSetup Pro) improperly published the private signing key in the public distribution and installed CA/root certificates into the local Trusted Root CA store. The root cause is the inclusion of the private key in the SennComCCKey.pem file, en...

CVE-2019-0901

CVE-2019-0901 maps to a Windows Jet Database Engine vulnerability. Connected CNVD entries describe a buffer overflow/heap overflow in Windows Jet Database Engine when memory boundaries are not validated, potentially allowing memory corruption on affected Windows/Windows Server systems. The CNVD d...

CVE-2019-0973

CVE-2019-0973 affects the Windows Installer. The issue stems from improper input sanitization that enables insecure library loading, leading to elevation of privilege. A locally authenticated attacker could execute arbitrary code with elevated system privileges, potentially installing programs, v...

CVE-2019-1078

CVE-2019-1078 is a Windows Graphics Component information-disclosure vulnerability. It stems from the component improperly handling memory objects, allowing an attacker to obtain information that could help compromise the system. An authenticated attacker could exploit this by running a specially...

CVE-2020-0703

CVE-2020-0703 affects the Windows Backup Service. It is an Elevation of Privilege vulnerability caused by improper handling of file operations. attacker must first gain execution on the victim system; the description does not provide a vendor-specific fix or version details in the provided docume...

CVE-2020-0791

CVE-2020-0791 is a Windows Graphics Component privilege-escalation vulnerability. Attackerkb aggregations cite a kernel-mode out-of-bounds dereference in win32kfull!vStrWrite01 that can be triggered from user-mode via gdi32!StretchBlt, potentially enabling arbitrary code execution with the caller...

CVE-2020-0960

CVE-2020-0960 is a Windows Jet Database Engine remote code execution vulnerability caused by improper handling of memory objects. The connected Microsoft KB4549951 entry confirms that a security update addressing the JET Database Engine was released (OS builds 18362.778/18363.778) and notes guida...

CVE-2020-1272

CVE-2020-1272 is a Windows Installer elevation-of-privilege vulnerability. The Windows Installer component is affected by improper input sanitization that leads to insecure library loading, enabling a locally authenticated attacker to execute arbitrary code with elevated system privileges. Exploi...

CVE-2020-1508

CVE-2020-1508 affects Windows Media Audio Decoder and is described as a remote code execution vulnerability. The connected document (AVLEONOV article) lists Windows Media Audio Decoder as vulnerable under the September 2020 Patch Tuesday with multiple CVEs, including CVE-2020-1508, indicating an ...

CVE-2020-17014

CVE-2020-17014 is a Windows Print Spooler elevation of privilege vulnerability. The NVD record lists a local, low-complexity attack with LOW privileges required and no user interaction, yielding HIGH integrity and availability impact (CVSS v3.1 base score 7.1; v2 base score 6.6). The provided doc...

CVE-2020-17038

Technical details for CVE-2020-17038 are not publicly available in the provided documents. No affected products, root cause, or remediation information are included. Monitor for updates.

CVE-2021-1673

CVE-2021-1673 is described as a Remote Procedure Call (RPC) Runtime Remote Code Execution vulnerability affecting Microsoft Windows/Windows Server. The CVE entry lists a high-severity CVSS score (3.1) of 8.8 with network access, low attack complexity, and no user interaction, implying reliable RC...

CVE-2021-1676

Technical details for CVE-2021-1676 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2022-34726

Technical details (affected component, root cause, impact, and fix) are not provided in the supplied documents; no concrete technical specifics are available. Monitor for official disclosures and updates.

CVE-2022-35833

Technical details about CVE-2022-35833 are not publicly available in the provided documents. The sources mention a Windows Secure Channel Denial of Service vulnerability, but no specifics on affected products, versions, impact, or fixes are included.

CVE-2023-33163

Technical details (affected products/versions, root cause, exploit information, or remediation) for CVE-2023-33163 are not provided in the connected documents. Monitor for future advisories from Microsoft and security bulletins.

CVE-2024-38125

CVE-2024-38125 affects the Windows Kernel Streaming WOW Thunk Service Driver and enables local elevation of privileges. The vulnerability is associated with the Kernel Streaming WOW Thunk Service Driver and can lead to obtaining elevated privileges (SYSTEM). Microsoft has issued fixes in August 2...

CVE-2024-43626

CVE-2024-43626 is a Windows Telephony Service Elevation of Privilege vulnerability. Affected: Windows operating systems where the Telephony Service component is present. Nature: local, low-privilege user could potentially elevate privileges (high impact to confidentiality, integrity, and availabi...

CVE-2024-43635

Technical details for CVE-2024-43635 are not publicly provided in the connected documents. The materials only reference a Windows Telephony Service RCE vulnerability. Monitor Microsoft advisories and vulnerability feeds for affected versions, impact, and remediation when they are disclosed.

CVE-2024-49124

According to the connected NCSC advisory, CVE-2024-49124 is an LDAP-related vulnerability in Windows LDAP with an impact described as Execution of random code (CVSS 8.1/8.10 range in the table). The advisory notes that Microsoft has fixed vulnerabilities and recommends applying the security updat...

CVE-2025-21221

CVE-2025-21221: Heap-based buffer overflow in Windows Telephony Service enables remote code execution over the network. Exploitation requires network access, no privileges, and user interaction is needed; impact is high on confidentiality, integrity, and availability. Affected component: Windows ...

CVE-2025-21222

CVE-2025-21222 is a remote-code-execution vulnerability in Windows Telephony Service characterized by a heap-based buffer overflow that an unauthenticated attacker can trigger over the network. Connected sources corroborate its association with Windows Telephony Service and document it as a netwo...

CVE-2025-21255

Technical details about CVE-2025-21255 are not provided in the supplied documents. Public information is limited to a basic description and references. Monitor Microsoft KBs/NVD for affected products, root cause, and remediation as updates are published.

CVE-2025-27484

CVE-2025-27484 affects Windows Universal Plug and Play (UPnP) Device Host. The issue is described as sensitive data storage in improperly locked memory, enabling an authorized attacker to elevate privileges over the network. Public details in connected docs indicate the vulnerability impacts the ...

CVE-2008-3013

CVE-2008-3013 corresponds to a GDI+ GIF parsing vulnerability. The connected KB954593 (MS08-052) describes remote code execution in Windows GDI+ when a user views a specially crafted GIF, affecting multiple Windows versions and Office components. The underlying issue is memory corruption during G...

CVE-2009-0091

CVE-2009-0091 is a Microsoft .NET Framework Type Verification Vulnerability. The issue involves .NET Framework 2.0, 2.0 SP1, and 3.5 where a type-equality check in verifiable code could be bypassed, allowing remote code execution via crafted XBAP, ASP.NET, or .NET Framework applications. Public d...

CVE-2016-7274

CVE-2016-7274 concerns the Windows Uniscribe component (usp10.dll). The issue stems from an integer/heap-related vulnerability in the LoadUvsTable() function that could enable remote code execution when processing untrusted font data via a crafted web site. Public analyses (e.g., Google Project Z...

CVE-2017-0084

CVE-2017-0084 concerns a remote code execution in Microsoft Windows Uniscribe (USP10) via font processing. The vulnerability is triggered by a crafted font during text rendering, leading to an invalid memory operation in USP10 which can be exploited to execute arbitrary code. Exploit details in p...

CVE-2017-0278

CVE-2017-0278 corresponds to a remote code execution vulnerability in the Microsoft Windows SMBv1 server. The issue is triggered by how the SMBv1 server handles certain requests, affecting multiple Windows editions (e.g., Windows 7, Windows 8.1, Windows Server 2008/2012/2016, and related .NET env...

CVE-2017-11781

CVE-2017-11781 is a denial-of-service vulnerability in the Microsoft Windows SMB Server (SMBv1) where an authenticated attacker can send specially crafted SMB requests to crash the server. Affected products include Windows SMB Server implementations as described in the CVE entry (server role comp...

CVE-2017-8687

CVE-2017-8687 is a Windows kernel information-disclosure vulnerability in the Win32k subsystem where improper handling of memory objects allows leakage of kernel memory to user mode. Affected products include Windows 7 SP1, Windows 8.1, Windows Server 2008 SP2/R2 SP1, Windows Server 2012, Windows...

CVE-2018-0887

CVE-2018-0887 describes an information-disclosure in the Windows kernel caused by improper initialization of a memory address. Affected products include multiple Windows versions (Windows 7, Windows 8.1, Windows 10 family and corresponding Server variants). The vulnerability exposes partial confi...

CVE-2018-8169

CVE-2018-8169 is a local elevation-of-privilege vulnerability in the HIDParser driver used by Windows HID parsing. The root cause, per CNVD-2018-11571, is that HIDParser fails to properly handle objects in memory, enabling a local attacker to execute code with higher privileges by running a craft...

CVE-2018-8486

CVE-2018-8486 is an information disclosure in DirectX caused by DirectX's improper handling of memory objects. Affected are Windows 7, Windows 8.1, Windows 10 and multiple Windows Server editions (e.g., 2008/R2, 2012, 2016, 2019). Root cause: memory objects not handled safely by DirectX. Impact: ...

CVE-2019-0961

The CVE-2019-0961 entry concerns Microsoft Windows GDI (Graphics Device Interface). The vulnerability arises from improper handling of memory objects, leading to information disclosure of memory contents in GDI. Affected component: Windows GDI in Microsoft Windows. Impact, as stated, is informati...

CVE-2019-1153

CVE-2019-1153 is a Windows Graphics Component information-disclosure vulnerability. It stems from improper handling of objects in memory, enabling an attacker who logs on and runs a specially crafted application to obtain information that could help further compromise the system. Mitigation is vi...

CVE-2019-1358

CVE-2019-1358 is a Windows Jet Database Engine Remote Code Execution vulnerability. The issue arises from improper handling of objects in memory within the JET Database Engine, enabling a remote attacker to potentially execute code. Connected Microsoft KB updates (e.g., KB4519990, KB4519998, KB45...

CVE-2020-0964

CVE-2020-0964 is a remote code execution vulnerability in Microsoft Windows GDI+ where memory objects are mishandled by the Graphics Device Interface. The issue affects GDI+ processing and can allow an attacker to run arbitrary code on a vulnerable system. Microsoft’s April 2020 Patch Tuesday upd...