Microsoft

IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability.

Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.

Use after free in Windows DNS allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.