CVE-2017-8590

CVE-2017-8590 is the Windows CLFS Elevation of Privilege vulnerability where the Common Log File System driver mishandles objects in memory, enabling local privilege elevation on affected Windows versions (Win7 SP1, Server 2008 SP2/R2 SP1, Win8.1/RT8.1, Server 2012/R2, Win10 1511/1607/1703, Serve...

CVE-2020-0682

Technical details about CVE-2020-0682 are not publicly provided in the supplied documents. No concrete affected product/version or remediation info is available here. Monitor for updates from official advisories.

CVE-2020-0698

Technical details for CVE-2020-0698 are not provided in the connected documents; the sources list the CVE but do not specify affected products, root cause, impact, or fixes. Monitor for updates from official advisories.

CVE-2020-1005

CVE-2020-1005 is an information-disclosure vulnerability in the Microsoft Windows Graphics Component. The connected documents identify the issue as an information-disclosure vulnerability that arises when Windows Graphics Components improperly handle objects in memory (root cause: memory handling...

CVE-2020-1154

CVE-2020-1154 : Elevation of privilege in the Windows Common Log File System (CLFS) Driver due to improper handling of objects in memory. The vulnerability enables local privilege escalation, with a high-severity impact (CONFIDENTIALITY/INTEGRITY/AVAILABILITY listed as HIGH in CVSS 3.1, and LOCAL...

CVE-2020-1252

Technical details for CVE-2020-1252 are not publicly available in the provided Connected Documents; the sources here reference related updates (e.g., RemoteFX, CVE-2020-1036) but do not specify affected product/version/root cause/mitigation for this CVE. Monitor for updates.

CVE-2020-1374

CVE-2020-1374 affects the Windows Remote Desktop Client. The provided documents describe a remote code execution vulnerability that can be triggered when a user connects to a malicious RDP server. The AVLEONOV summary echoes that this is an RDP Client RCE affecting Windows 7 through Windows 10 (u...

CVE-2021-26862

Technical details about CVE-2021-26862 (affected product/component, root cause, impact, or patch) are not provided in the connected documents. Monitor official advisories for updates; current sources only confirm the vulnerability name/type without specifics.

CVE-2021-40441

Technical details about CVE-2021-40441 are not publicly provided in the supplied documents. No concrete information on affected products/versions, root cause, impact, or fixes is available here; monitor for updates from official advisories.

CVE-2023-35622

CVE-2023-35622 affects the Windows DNS component and is associated with a spoofing/impersonation risk (impact: pretend to be another user) with a CVSS v3.1 base score of 7.5. The connected documents indicate Microsoft has released security updates in December 2023 addressing Windows DNS vulnerabi...

CVE-2024-38052

Technical details for CVE-2024-38052 are not publicly available in the provided documents. No affected products, root cause, impact, or remediation are specified here. Monitor official sources for updates.

CVE-2025-21246

CVE-2025-21246 is a Windows Telephony Service remote code execution vulnerability with a CVSS v3.1 base score of 8.8 (HIGH) and network attack vector. The provided connected documents confirm this CVE and indicate Microsoft has released updates to address it (e.g., KB5050009 and related January 2...

CVE-2025-21289

CVE-2025-21289 is a denial-of-service vulnerability in Microsoft Message Queuing (MSMQ). Public details in the provided documents show a network‑accessible issue with a CVSS 3.1 base score of 7.5 (HIGH) where no user interaction is required and no privileges are needed to trigger the impact of de...

CVE-2025-21320

CVE-2025-21320 is a Windows kernel memory information disclosure vulnerability. The CVE is documented as a local, memory-information leakage issue with low attack complexity and low privileges required, potentially exposing high-confidentiality data. Public details provided in connected sources a...

CVE-2009-3677

CVE-2009-3677 describes an elevation-of-privilege bypass in the Internet Authentication Service (IAS) used by Microsoft Windows products. The issue arises because MS-CHAP v2 authentication requests sent over PEAP are not properly validated, allowing remote attackers to gain access to network reso...

CVE-2010-2552

CVE-2010-2552 is the SMB Stack Exhaustion vulnerability in the SMB Server of affected Windows platforms. It occurs when the SMBv2 compounded requests are malformed, causing a denial-of-service (system hang). Affected products per sources include Windows Vista SP1/SP2, Windows Server 2008 (Gold/SP...

CVE-2015-2368

CVE-2015-2368 is a Windows untrusted search path vulnerability that allows local privilege escalation by placing a Trojan DLL in the current working directory. Affected: Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1. Root cause: DLL hijack when a p...

CVE-2015-2552

CVE-2015-2552 concerns the Windows kernel across multiple editions (Windows 8/8.1, Server 2012, RT, Windows 10). The vulnerability enables physically proximate attackers to bypass Trusted Boot via a crafted Boot Configuration Data (BCD) setting, which can compromise code integrity and protections...

CVE-2016-3239

The CVE-2016-3239 issue is a local privilege-escalation vulnerability in the Windows Print Spooler component. Affected systems include Windows Vista/7/8.1/10 and corresponding Server SKUs where the Print Spooler can write to the filesystem, enabling local attackers to gain elevated privileges. Mi...

CVE-2016-3254

CVE-2016-3254 is a Win32k Elevation of Privilege vulnerability affecting multiple Windows releases (Vista to Windows 10) where a crafted user-mode application can cause a kernel-mode elevation via Windows kernel drivers. The description specifies local privileges escalation but the documents do n...

CVE-2016-3368

CVE-2016-3368 affects multiple Windows editions (Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, 8.1, Server 2012 Gold/R2, Windows RT 8.1, and Windows 10 (initial 1511/1607)). It is a remote code execution vulnerability caused by how Windows handles objects in memory. An attacker with domain cr...

CVE-2016-7214

Technical details about CVE-2016-7214 are not publicly provided in the supplied documents. The connected EUVD/NVD entries do not reveal affected products or root causes here. Monitor for updates from official advisories.

CVE-2017-0089

CVE-2017-0089 affects Microsoft Windows Uniscribe (USP10) used by the Uniscribe font processing path in user32.dll. The vulnerability arises from a memory corruption in USP10!MergeLigRecords, enabling remote code execution when a user visits a crafted web page. Affected platforms listed in the in...

CVE-2017-0092

CVE-2017-0092 affects Uniscribe (usp10.dll) in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1. The vulnerability enables an attacker-controlled website to cause memory information disclosure from the affected process. The CVE entry lists a CVSS v3 base score of 4.3 (Medi...

CVE-2017-0286

Technical details for CVE-2017-0286 are not publicly provided in the connected documents. Monitor for updates in the provided sources; current materials do not disclose affected products, root cause, impact, or fixes.

CVE-2017-8483

Technical details about CVE-2017-8483 are not publicly provided in the supplied documents. The connected EUVD entries reference malware but do not describe affected products, vulnerable components, exploitation or fixes. Monitor for updates.

CVE-2017-8592

CVE-2017-8592 is a browser security feature bypass in Microsoft browsers (Internet Explorer/Edge) caused by improper handling of redirect requests. This leads to bypassing CORS redirect restrictions and following redirects that should be ignored, potentially exposing data to an attacker. In the c...

CVE-2017-8620

CVE-2017-8620 is a Windows Search Remote Code Execution vulnerability. The issue arises when Windows Search improperly handles objects in memory, allowing a remote attacker to execute code on the affected system. Multiple connected sources (Nessus/OpenVAS plugins) confirm this CVE is tied to the ...

CVE-2017-8678

CVE-2017-8678 is a Win32k information-disclosure vulnerability in the Windows kernel. Affected products include Windows 7 SP1, Windows 8.1, Windows Server 2008/R2 SP1, Windows Server 2012, Windows RT 8.1, Windows 10 (various builds), and Windows Server 2016. The root cause is improper handling of...

CVE-2020-0705

CVE-2020-0705 is an information-disclosure vulnerability in Windows’ Network Driver Interface Specification (NDIS) where memory handling is improper. The issue can disclose information from memory and requires prior execution on the target (local access with low attack complexity per CVSS v3.1: A...

CVE-2020-0756

Technical details for CVE-2020-0756 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2020-0845

Technical details for CVE-2020-0845 are not publicly available in the provided documents; monitor for updates.

CVE-2020-0853

CVE-2020-0853 is a Windows Imaging Component information-disclosure vulnerability rooted in uninitialized memory in Windows image decoders. FireEye’s analysis shows uninitialized memory in windowscodecs!CFormatConverter::Initialize led to leaking pixel data during TIFF/image decoding; PoC output ...

CVE-2020-1072

CVE-2020-1072 is described as a Windows kernel information disclosure vulnerability caused by the kernel’s improper handling of objects in memory. The connected CNVD entry repeats this description, confirming an information-disclosure risk stemming from memory object handling in Windows kernel sp...

CVE-2020-1097

CVE-2020-1097 describes an information-disclosure vulnerability in the Windows GDI component where memory contents could be exposed due to improper handling of objects in memory. An attacker could exploit this by convincing a user to open a specially crafted document or visit a malicious webpage,...

CVE-2020-1359

CVE-2020-1359 is a Windows elevation-of-privilege issue tied to the CNG Key Isolation Service. The vulnerability arises from improper memory handling in the Windows CNG Key Isolation Service, enabling local privilege escalation on affected Windows/Windows Server systems. Connected records also re...

CVE-2020-1399

Technical details for CVE-2020-1399 are not present in the provided connected documents. Public EUVD entries mention malware but do not describe the vulnerability specifics. Monitor for updates.

CVE-2021-24107

Technical details for CVE-2021-24107 are not publicly provided in the connected documents; sources mention the vulnerability name in update KBs but do not specify affected products, root cause, or fixes.

CVE-2021-43245

CVE-2021-43245 is a Windows Digital TV Tuner Elevation of Privilege vulnerability. The NVD entry lists a local attack vector with low complexity and no authentication required, yielding partial confidentiality, integrity, and availability impact (CVSS 3.1: 7.8 HIGH; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:...

CVE-2024-38245

CVE-2024-38245 is a Windows Kernel Streaming Service Driver elevation-of-privilege flaw. A local attacker could exploit it with low privileges and no user interaction to gain SYSTEM-level access; CVSS v3.1/3.1 vector indicates local access, low complexity, with high impact to confidentiality, int...

CVE-2024-43643

CVE-2024-43643 is a Windows USB Video Class System Driver elevation-of-privilege vulnerability. The vulnerability pertains to the Windows USB Video Driver component and is categorized with CVSSv3.1 vektor: physical attack, low complexity, no privileges required, no user interaction, and impacts t...

CVE-2025-21288

Technical details about CVE-2025-21288 are not publicly provided in the supplied connected documents; the record notes a Windows COM Server information disclosure vulnerability but lacks specifics on affected products/versions or mitigations. Monitor for official disclosures.

CVE-2025-21336

Technical details about CVE-2025-21336 are not publicly provided in the supplied documents. The materials reference a Windows cryptographic information disclosure vulnerability but do not specify affected products/versions or fixes.

CVE-2009-2514

CVE-2009-2514 is a Win32k.sys remote code execution vulnerability in the embedded OpenType (EOT) font parsing path. The kernel component on Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2 parses EOT fonts and can be coerced by a crafted font to execute arbitrary code with kernel privileges. The...

CVE-2010-0477

CVE-2010-0477 is a remote code execution vulnerability in the Microsoft SMB client. The SMB client in Windows 7 and Windows Server 2008 R2 can be tricked by specially crafted SMB responses (affecting both SMBv1 and SMBv2), allowing an unauthenticated remote attacker to execute arbitrary code on t...

CVE-2013-3661

CVE-2013-3661 affects Windows with the EPATHOBJ::bFlatten function in win32k.sys across Windows XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8, Server 2012, and Windows RT. The root cause is improper checking of linked-list traversal in PATHRECORD chains,...

CVE-2014-0300

CVE-2014-0300 is a Windows kernel-mode driver (Win32k.sys) elevation-of-privilege vulnerability affecting multiple Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, Windows 7, 8, 8.1, Server 2012) where local attackers can gain privileges via a crafted application. Roo...

CVE-2015-1758

CVE-2015-1758 is the LoadLibrary EoP vulnerability in the Windows kernel affecting Windows Vista SP2, Server 2008 SP2/R2 SP1, Windows 7 SP1, 8, Server 2012, and Windows RT. The issue stems from untrusted search path loading a Trojan DLL in an unspecified directory, enabling local privilege escala...

CVE-2015-2369

CVE-2015-2369 describes an untrusted search path vulnerability in Windows Media Device Manager that allows local privilege escalation by placing a malicious DLL in the current directory, demonstrated via a crafted .RTF file. Affected OS versions include Windows Server 2003 SP2, Windows Vista SP2,...

CVE-2015-2510

CVE-2015-2510 is a buffer overflow vulnerability in the Adobe Type Manager Library used by multiple Windows components (Vista SP2, Server 2008 SP2, Office 2007 SP3/2010 SP2, Lync and Live Meeting suites). The issue arises when processing crafted OpenType fonts, allowing remote code execution with...