Vendor CVEs

Microsoft

All CVEs

14,319 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-0819	Microsoft Office For Mac	Med	0.43	6.5	0.06	Jan 10, 2018	Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, such as phishing, due to how Outlook for Mac displays encoded email addresses, aka "Spoofing Vulnerability in Microsoft…
CVE-2018-0767	Microsoft Edge	Med	0.43	5.3	0.65	Jan 4, 2018	Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure…
CVE-2017-11939	Microsoft Office	Med	0.43	6.5	0.06	Dec 12, 2017	Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability".
CVE-2017-11927	Microsoft Windows Server 2008	Med	0.43	6.5	0.10	Dec 12, 2017	Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an information vulnerability due to the way the Windows its:// protocol…
CVE-2017-11872	Microsoft Edge	Med	0.43	6.5	0.07	Nov 15, 2017	Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would otherwise be restricted to a destination website of the attacker's choice, due to how Microsoft Edge handles redirect requests, aka…
CVE-2017-8611	Microsoft Edge	Med	0.43	6.5	0.12	Jul 11, 2017	Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability."
CVE-2017-8602	Microsoft Internet Explorer	Med	0.43	6.5	0.05	Jul 11, 2017	Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a spoofing vulnerability in the way they parse HTTP content, aka "Microsoft…
CVE-2017-8599	Microsoft Edge	Med	0.43	6.5	0.05	Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents,…
CVE-2017-8592	Microsoft Windows Server 2008	Med	0.43	6.5	0.08	Jul 11, 2017	Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a security feature bypass vulnerability when they improperly handle…
CVE-2017-8587	Microsoft Windows Server 2008	Med	0.43	6.5	0.06	Jul 11, 2017	Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511 allows a denial of service vulnerability when it attempts to open a non-existent file, aka "Windows Explorer Denial of…
CVE-2017-0170	Microsoft Windows Server 2008	Med	0.43	6.5	0.07	Jul 11, 2017	Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML…
CVE-2017-8545	Microsoft Outlook	Med	0.43	6.5	0.05	Jun 15, 2017	A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVE-2017-8534	Microsoft Office	Med	0.43	6.5	0.06	Jun 15, 2017	Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents,…
CVE-2017-8533	Microsoft Windows Server 2008	Med	0.43	6.5	0.08	Jun 15, 2017	Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…
CVE-2017-8532	Microsoft Windows Server 2008	Med	0.43	6.5	0.07	Jun 15, 2017	Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…
CVE-2017-8531	Microsoft Office	Med	0.43	6.5	0.07	Jun 15, 2017	Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 Service Pack 3, and Microsoft Office 2010 Service Pack 2 allows improper…
CVE-2017-8529	Microsoft Internet Explorer	Med	0.43	6.5	0.14	Jun 15, 2017	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in…
CVE-2017-0235	Microsoft Edge	Hig	0.43	7.5	0.11	May 12, 2017	A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229,…
CVE-2017-0224	Microsoft Edge	Hig	0.43	7.5	0.11	May 12, 2017	A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234,…
CVE-2017-0064	Microsoft Internet Explorer	Med	0.43	6.5	0.05	May 12, 2017	A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVE-2017-0207	Microsoft Outlook	Med	0.43	6.5	0.10	Apr 12, 2017	Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."
CVE-2017-0017	Microsoft Edge	Med	0.43	6.1	0.42	Mar 17, 2017	The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from…
CVE-2016-7243	Microsoft Edge	Hig	0.43	7.5	0.15	Nov 10, 2016	The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-7242	Microsoft Edge	Hig	0.43	7.5	0.16	Nov 10, 2016	The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-7226	Microsoft Windows Server 2016	Med	0.43	6.1	0.04	Nov 10, 2016	Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."
CVE-2016-7225	Microsoft Windows Server 2016	Med	0.43	6.1	0.04	Nov 10, 2016	Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."
CVE-2016-7224	Microsoft Windows Server 2012	Med	0.43	6.1	0.04	Nov 10, 2016	Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka…
CVE-2016-7208	Microsoft Edge	Hig	0.43	7.5	0.15	Nov 10, 2016	The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-3390	Microsoft Internet Explorer	Hig	0.43	7.5	0.17	Oct 14, 2016	The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory…
CVE-2016-3389	Microsoft Edge	Hig	0.43	7.5	0.15	Oct 14, 2016	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386,…
CVE-2016-3382	Microsoft Internet Explorer	Hig	0.43	7.5	0.17	Oct 14, 2016	The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine…
CVE-2016-3209	Microsoft Office	Med	0.43	5.5	0.54	Oct 14, 2016	Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for…
CVE-2016-3377	Microsoft Edge	Hig	0.43	7.5	0.16	Sep 14, 2016	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3350.
CVE-2016-3372	Microsoft Windows	Med	0.43	6.6	0.02	Sep 14, 2016	The kernel API in Microsoft Windows Vista SP2 and Windows Server 2008 SP2 does not properly enforce permissions, which allows local users to spoof processes, spoof inter-process communication, or cause a denial of service via a crafted application, aka "Windows Kernel Elevation…
CVE-2016-3350	Microsoft Edge	Hig	0.43	7.5	0.15	Sep 14, 2016	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377.
CVE-2016-0141	Microsoft Office	Med	0.43	6.5	0.05	Sep 14, 2016	The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure…
CVE-2016-3245	Microsoft Internet Explorer	Med	0.43	6.5	0.15	Jul 13, 2016	Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVE-2016-3226	Microsoft Windows Server 2008	Med	0.43	6.5	0.11	Jun 16, 2016	Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service hang) by creating many machine accounts, aka "Active Directory Denial of Service Vulnerability."
CVE-2016-3202	Microsoft Jscript	Hig	0.43	7.5	0.17	Jun 16, 2016	The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka…
CVE-2016-0193	Microsoft Edge	Hig	0.43	7.5	0.20	May 11, 2016	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and…
CVE-2016-0186	Microsoft Edge	Hig	0.43	7.5	0.19	May 11, 2016	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and…
CVE-2016-0158	Microsoft Edge	Med	0.43	6.5	0.15	Apr 12, 2016	Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161.
CVE-2016-1715	McAfee Application Control	Med	0.43	6.6	0.02	Jan 12, 2016	The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 before build 441, and 6.2.0 before build 505 on 32-bit Windows platforms allows local users to cause a denial of service (memory…
CVE-2008-5180	Microsoft Office	Med	0.43	5.3	0.68	Nov 20, 2008	Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.
CVE-2026-50508	Microsoft Windows	Med	0.42	6.5	0.01	Jun 9, 2026	Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-47287	Microsoft Visual Studio Code	Med	0.42	6.5	0.01	Jun 9, 2026	Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284	Microsoft Visual Studio Code	Med	0.42	6.5	0.01	Jun 9, 2026	Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45591	Microsoft Aspnetcore	Hig	0.42	7.5	0.02	Jun 9, 2026	Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45501	Microsoft Exchange Server	Med	0.42	6.5	0.00	Jun 9, 2026	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45454	Microsoft Office SharePoint	Med	0.42	6.5	0.02	Jun 9, 2026	Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2018-0819MedJan 10, 2018
Microsoft
Office For Mac
risk 0.43cvss 6.5epss 0.06
Microsoft Office 2016 for Mac allows an attacker to send a specially crafted email attachment to a user in an attempt to launch a social engineering attack, such as phishing, due to how Outlook for Mac displays encoded email addresses, aka "Spoofing Vulnerability in Microsoft…
CVE-2018-0767MedJan 4, 2018
Microsoft
Edge
risk 0.43cvss 5.3epss 0.65
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure…
CVE-2017-11939MedDec 12, 2017
Microsoft
Office
risk 0.43cvss 6.5epss 0.06
Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability".
CVE-2017-11927MedDec 12, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.10
Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an information vulnerability due to the way the Windows its:// protocol…
CVE-2017-11872MedNov 15, 2017
Microsoft
Edge
risk 0.43cvss 6.5epss 0.07
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to force the browser to send data that would otherwise be restricted to a destination website of the attacker's choice, due to how Microsoft Edge handles redirect requests, aka…
CVE-2017-8611MedJul 11, 2017
Microsoft
Edge
risk 0.43cvss 6.5epss 0.12
Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability."
CVE-2017-8602MedJul 11, 2017
Microsoft
Internet Explorer
risk 0.43cvss 6.5epss 0.05
Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a spoofing vulnerability in the way they parse HTTP content, aka "Microsoft…
CVE-2017-8599MedJul 11, 2017
Microsoft
Edge
risk 0.43cvss 6.5epss 0.05
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents,…
CVE-2017-8592MedJul 11, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.08
Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a security feature bypass vulnerability when they improperly handle…
CVE-2017-8587MedJul 11, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.06
Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511 allows a denial of service vulnerability when it attempts to open a non-existent file, aka "Windows Explorer Denial of…
CVE-2017-0170MedJul 11, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.07
Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML…
CVE-2017-8545MedJun 15, 2017
Microsoft
Outlook
risk 0.43cvss 6.5epss 0.05
A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVE-2017-8534MedJun 15, 2017
Microsoft
Office
risk 0.43cvss 6.5epss 0.06
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents,…
CVE-2017-8533MedJun 15, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.08
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…
CVE-2017-8532MedJun 15, 2017
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.07
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…
CVE-2017-8531MedJun 15, 2017
Microsoft
Office
risk 0.43cvss 6.5epss 0.07
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 Service Pack 3, and Microsoft Office 2010 Service Pack 2 allows improper…
CVE-2017-8529MedJun 15, 2017
Microsoft
Internet Explorer
risk 0.43cvss 6.5epss 0.14
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in…
CVE-2017-0235HigMay 12, 2017
Microsoft
Edge
risk 0.43cvss 7.5epss 0.11
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229,…
CVE-2017-0224HigMay 12, 2017
Microsoft
Edge
risk 0.43cvss 7.5epss 0.11
A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234,…
CVE-2017-0064MedMay 12, 2017
Microsoft
Internet Explorer
risk 0.43cvss 6.5epss 0.05
A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVE-2017-0207MedApr 12, 2017
Microsoft
Outlook
risk 0.43cvss 6.5epss 0.10
Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."
CVE-2017-0017MedMar 17, 2017
Microsoft
Edge
risk 0.43cvss 6.1epss 0.42
The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from…
CVE-2016-7243HigNov 10, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.15
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-7242HigNov 10, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.16
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-7226MedNov 10, 2016
Microsoft
Windows Server 2016
risk 0.43cvss 6.1epss 0.04
Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."
CVE-2016-7225MedNov 10, 2016
Microsoft
Windows Server 2016
risk 0.43cvss 6.1epss 0.04
Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."
CVE-2016-7224MedNov 10, 2016
Microsoft
Windows Server 2012
risk 0.43cvss 6.1epss 0.04
Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka…
CVE-2016-7208HigNov 10, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.15
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…
CVE-2016-3390HigOct 14, 2016
Microsoft
Internet Explorer
risk 0.43cvss 7.5epss 0.17
The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory…
CVE-2016-3389HigOct 14, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.15
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386,…
CVE-2016-3382HigOct 14, 2016
Microsoft
Internet Explorer
risk 0.43cvss 7.5epss 0.17
The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine…
CVE-2016-3209MedOct 14, 2016
Microsoft
Office
risk 0.43cvss 5.5epss 0.54
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for…
CVE-2016-3377HigSep 14, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.16
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3350.
CVE-2016-3372MedSep 14, 2016
Microsoft
Windows
risk 0.43cvss 6.6epss 0.02
The kernel API in Microsoft Windows Vista SP2 and Windows Server 2008 SP2 does not properly enforce permissions, which allows local users to spoof processes, spoof inter-process communication, or cause a denial of service via a crafted application, aka "Windows Kernel Elevation…
CVE-2016-3350HigSep 14, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.15
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377.
CVE-2016-0141MedSep 14, 2016
Microsoft
Office
risk 0.43cvss 6.5epss 0.05
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure…
CVE-2016-3245MedJul 13, 2016
Microsoft
Internet Explorer
risk 0.43cvss 6.5epss 0.15
Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVE-2016-3226MedJun 16, 2016
Microsoft
Windows Server 2008
risk 0.43cvss 6.5epss 0.11
Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service hang) by creating many machine accounts, aka "Active Directory Denial of Service Vulnerability."
CVE-2016-3202HigJun 16, 2016
Microsoft
Jscript
risk 0.43cvss 7.5epss 0.17
The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka…
CVE-2016-0193HigMay 11, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.20
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and…
CVE-2016-0186HigMay 11, 2016
Microsoft
Edge
risk 0.43cvss 7.5epss 0.19
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and…
CVE-2016-0158MedApr 12, 2016
Microsoft
Edge
risk 0.43cvss 6.5epss 0.15
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161.
CVE-2016-1715MedJan 12, 2016
McAfee
Application Control
risk 0.43cvss 6.6epss 0.02
The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 before build 441, and 6.2.0 before build 505 on 32-bit Windows platforms allows local users to cause a denial of service (memory…
CVE-2008-5180MedNov 20, 2008
Microsoft
Office
risk 0.43cvss 5.3epss 0.68
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.
CVE-2026-50508MedJun 9, 2026
Microsoft
Windows
risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-47287MedJun 9, 2026
Microsoft
Visual Studio Code
risk 0.42cvss 6.5epss 0.01
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284MedJun 9, 2026
Microsoft
Visual Studio Code
risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45591HigJun 9, 2026
Microsoft
Aspnetcore
risk 0.42cvss 7.5epss 0.02
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45501MedJun 9, 2026
Microsoft
Exchange Server
risk 0.42cvss 6.5epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45454MedJun 9, 2026
Microsoft
Office SharePoint
risk 0.42cvss 6.5epss 0.02
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Page 149 of 287