Microsoft

Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted "change batch" data, aka "Windows DLL Loading Denial of Service Vulnerability."

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of…

The IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Element Memory…

Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.

By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS cache via spoofed DNS responses.

FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded.

IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.

Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability.

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network.

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.

Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.

Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network.

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.