VYPR
← Microsoft

Vendor CVEs

Microsoft

All CVEs

14,175 total · sorted by risk
  • CVE-2015-1635CriKEVApr 14, 2015
    Microsoft
    Windows Server 2008
    risk 0.87cvss 9.8epss 1.00

    HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

  • CVE-2008-4250CriKEVOct 23, 2008
    Microsoft
    Windows 2000
    risk 0.87cvss 9.8epss 0.99

    The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as…

  • CVE-2017-0144HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.86cvss 8.8epss 0.99

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0143HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.86cvss 8.8epss 0.93

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2015-0313CriKEVFeb 2, 2015
    Microsoft
    Internet Explorer
    risk 0.86cvss 9.8epss 0.96

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015,…

  • CVE-2015-0311CriKEVJan 23, 2015
    Microsoft
    Internet Explorer
    risk 0.86cvss 9.8epss 0.86

    Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

  • CVE-2017-0146HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.85cvss 8.8epss 0.90

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0145HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.85cvss 8.8epss 0.90

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2013-2551HigKEVMar 11, 2013
    Microsoft
    Internet Explorer
    risk 0.84cvss 8.8epss 0.74

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet…

  • CVE-2014-1812HigKEVMay 14, 2014
    Microsoft
    Windows
    risk 0.83cvss 8.8epss 0.64

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain…

  • CVE-2014-1776CriKEVApr 27, 2014
    Microsoft
    Internet Explorer
    risk 0.83cvss 9.8epss 0.88

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April…

  • CVE-2017-8543CriKEVJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.82cvss 9.8epss 0.74

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an…

  • CVE-2017-0148HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.82cvss 8.1epss 0.99

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2016-0034HigKEVJan 13, 2016
    Microsoft
    Silverlight
    risk 0.81cvss 8.8epss 0.70

    Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution…

  • CVE-2017-11882HigKEVNov 15, 2017
    Microsoft
    Office
    risk 0.80cvss 7.8epss 1.00

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft…

  • CVE-2017-0199HigKEVApr 12, 2017
    Microsoft
    Office
    risk 0.80cvss 7.8epss 1.00

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft…

  • CVE-2017-7269CriKEVMar 27, 2017
    Microsoft
    Internet Information Server
    risk 0.80cvss 9.8epss 1.00

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as…

  • CVE-2014-6332HigKEVNov 11, 2014
    Microsoft
    Windows
    risk 0.80cvss 8.8epss 0.95

    OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted…

  • CVE-2012-0158HigKEVApr 10, 2012
    Microsoft
    Office
    risk 0.80cvss 8.8epss 1.00

    The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and…

  • CVE-2011-1889CriKEVJun 16, 2011
    Microsoft
    Forefront Threat Management Gateway
    risk 0.80cvss 9.8epss 0.48

    The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability."

  • CVE-2010-0249HigKEVJan 15, 2010
    Microsoft
    Internet Explorer
    risk 0.80cvss 8.8epss 0.92

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute…

  • CVE-2017-8464HigKEVJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.79cvss 8.8epss 0.90

    Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via…

  • CVE-2015-2426HigKEVJul 20, 2015
    Microsoft
    Windows
    risk 0.79cvss 8.8epss 0.87

    Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute…

  • CVE-2014-6324HigKEVNov 18, 2014
    Microsoft
    Windows Server 2003
    risk 0.79cvss 8.8epss 0.87

    The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain…

  • CVE-2014-0322HigKEVFeb 14, 2014
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.85

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February…

  • CVE-2013-3893HigKEVSep 18, 2013
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.86

    Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of…

  • CVE-2012-4792HigKEVDec 30, 2012
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.79

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and…

  • CVE-2012-1889HigKEVJun 13, 2012
    Microsoft
    XML Core Services
    risk 0.79cvss 8.8epss 0.84

    Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2010-0806HigKEVMar 10, 2010
    Microsoft
    Internet Explorer
    risk 0.79cvss 8.8epss 0.82

    Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the…

  • CVE-2018-0824HigKEVMay 9, 2018
    Microsoft
    COM for Windows
    risk 0.78cvss 8.8epss 0.73

    A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server…

  • CVE-2017-0147HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.78cvss 7.5epss 1.00

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information…

  • CVE-2013-3918HigKEVNov 12, 2013
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.74

    The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…

  • CVE-2013-3897HigKEVOct 9, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.77

    Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event…

  • CVE-2013-3163HigKEVJul 10, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.71

    Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and…

  • CVE-2013-1347HigKEVMay 5, 2013
    Microsoft
    Internet Explorer
    risk 0.78cvss 8.8epss 0.78

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.

  • CVE-2013-0074HigKEVMar 13, 2013
    Microsoft
    Silverlight
    risk 0.78cvss 7.8epss 0.82

    Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference…

  • CVE-2011-3402HigKEVNov 4, 2011
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.78

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to…

  • CVE-2008-0015HigKEVJul 7, 2009
    Microsoft
    Windows
    risk 0.78cvss 8.8epss 0.77

    Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2,…

  • CVE-2023-21529HigKEVFeb 14, 2023
    Microsoft
    Exchange Server
    risk 0.77cvss 8.8epss 0.62

    Microsoft Exchange Server Remote Code Execution Vulnerability

  • CVE-2018-8453HigKEVOct 10, 2018
    Microsoft
    Windows
    risk 0.77cvss 7.8epss 0.70

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-8174HigKEVMay 9, 2018
    Microsoft
    Vbscript
    risk 0.77cvss 7.5epss 0.88

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-0798HigKEVJan 10, 2018
    Microsoft
    Office
    risk 0.77cvss 8.8epss 0.95

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".

  • CVE-2016-0151HigKEVApr 12, 2016
    Microsoft
    Windows Server 2012
    risk 0.77cvss 7.8epss 0.63

    The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security…

  • CVE-2026-20963CriKEVJan 13, 2026
    Microsoft
    Sharepoint Server
    risk 0.76cvss 9.8epss 0.31

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  • CVE-2017-0101HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.76cvss 7.8epss 0.57

    The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain…

  • CVE-2015-2419HigKEVJul 14, 2015
    Microsoft
    Internet Explorer
    risk 0.76cvss 8.8epss 0.45

    JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

  • CVE-2015-1701HigKEVApr 21, 2015
    Microsoft
    Windows
    risk 0.76cvss 7.8epss 0.56

    Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

  • CVE-2018-8414HigKEVAug 15, 2018
    Microsoft
    Windows Shell
    risk 0.75cvss 8.8epss 0.74

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

  • CVE-2017-0213HigKEVMay 12, 2017
    Microsoft
    Windows Server 2008
    risk 0.75cvss 7.3epss 0.84

    Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an…

  • CVE-2016-0099HigKEVMar 9, 2016
    Microsoft
    Windows
    risk 0.75cvss 7.8epss 0.37

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain…

Page 1 of 284