Vendor CVEs

Microsoft

All CVEs

15,666 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2019-0870	Microsoft Team Foundation Server	Med	0.40	6.1	0.02	Apr 9, 2019	A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0869	Microsoft Azure Devops Server	Med	0.40	6.1	0.02	Apr 9, 2019	A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.
CVE-2019-0868	Microsoft Team Foundation Server	Med	0.40	6.1	0.02	Apr 9, 2019	A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0867	Microsoft Team Foundation Server	Med	0.40	6.1	0.02	Apr 9, 2019	A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0866	Microsoft Team Foundation Server	Med	0.40	6.1	0.03	Apr 9, 2019	A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867,…
CVE-2019-0858	Microsoft Exchange Server	Med	0.40	6.1	0.02	Apr 9, 2019	A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
CVE-2019-0798	Microsoft Lync Server	Med	0.40	6.1	0.02	Apr 9, 2019	A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.
CVE-2019-0670	Microsoft Sharepoint Server	Med	0.40	6.1	0.02	Mar 5, 2019	A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerability'.
CVE-2019-0635	Microsoft Windows Hyper-V	Med	0.40	6.2	0.02	Mar 5, 2019	An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVE-2018-8600	Microsoft Azure App Service	Med	0.40	6.1	0.02	Nov 14, 2018	A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App.
CVE-2018-8470	Microsoft Internet Explorer	Med	0.40	6.1	0.03	Sep 13, 2018	A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.
CVE-2018-8437	Microsoft Hyper-V Network Switch	Med	0.40	6.2	0.02	Sep 13, 2018	A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-8436	Microsoft Hyper-V Network Switch	Med	0.40	6.2	0.02	Sep 13, 2018	A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-8278	Microsoft Edge	Med	0.40	6.1	0.06	Jul 11, 2018	A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge.
CVE-2018-8239	Microsoft Windows Server 2016	Med	0.40	5.5	0.58	Jun 14, 2018	An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVE-2018-0964	Microsoft Hyper-V	Med	0.40	6.1	0.02	Apr 12, 2018	An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-0908	Microsoft Identity Manager	Med	0.40	6.1	0.02	Feb 26, 2018	Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a specially crafted attribute value being displayed to a user on an affected MIM 2016 server, aka "Microsoft Identity Manager XSS Elevation of Privilege…
CVE-2018-0799	Microsoft Access	Med	0.40	6.1	0.04	Jan 10, 2018	Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scripting (XSS) vulnerability due to the way image field values are handled, aka "Microsoft Access Tampering Vulnerability".
CVE-2017-11863	Microsoft Edge	Med	0.40	6.1	0.03	Nov 15, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user into loading a page containing malicious content, due to how the Edge Content Security Policy (CSP) validates documents,…
CVE-2017-8758	Microsoft Exchange Server	Med	0.40	6.1	0.03	Sep 13, 2017	Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
CVE-2017-8683	Microsoft Windows Server 2008	Med	0.40	5.5	0.23	Sep 13, 2017	Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded…
CVE-2017-8642	Microsoft Edge	Med	0.40	6.1	0.03	Aug 8, 2017	Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
CVE-2017-8621	Microsoft Exchange Server	Med	0.40	6.1	0.03	Jul 11, 2017	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
CVE-2017-8560	Microsoft Exchange Server	Med	0.40	6.1	0.03	Jul 11, 2017	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site…
CVE-2017-8559	Microsoft Exchange Server	Med	0.40	6.1	0.03	Jul 11, 2017	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site…
CVE-2017-8551	Microsoft Project Server	Med	0.40	6.1	0.03	Jun 15, 2017	An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".
CVE-2017-8550	Microsoft Skype For Business	Med	0.40	5.4	0.22	Jun 15, 2017	A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".
CVE-2017-8537	Microsoft Exchange Server	Med	0.40	5.5	0.17	May 26, 2017	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-8536	Microsoft Exchange Server	Med	0.40	5.5	0.17	May 26, 2017	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-8535	Microsoft Exchange Server	Med	0.40	5.5	0.17	May 26, 2017	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-0211	Microsoft Windows Server 2012	Med	0.40	5.5	0.14	Apr 12, 2017	An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka "Windows OLE Elevation of Privilege…
CVE-2017-0110	Microsoft Exchange Server	Med	0.40	6.1	0.07	Mar 17, 2017	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."
CVE-2017-0107	Microsoft Sharepoint Server	Med	0.40	6.1	0.07	Mar 17, 2017	Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."
CVE-2017-0060	Microsoft Windows	Med	0.40	5.5	0.16	Mar 17, 2017	The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from…
CVE-2017-0016	Microsoft Windows Server 2012	Med	0.40	5.9	0.26	Mar 17, 2017	Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets, which allows remote attackers to execute arbitrary code via a crafted SMBv2 or SMBv3 packet…
CVE-2016-7282	Microsoft Internet Explorer	Med	0.40	6.1	0.10	Dec 20, 2016	Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2016-7280	Microsoft Edge	Med	0.40	6.1	0.09	Dec 20, 2016	Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.
CVE-2016-7206	Microsoft Edge	Med	0.40	6.1	0.12	Dec 20, 2016	Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7280.
CVE-2016-7251	Microsoft SQL Server	Med	0.40	6.1	0.08	Nov 10, 2016	Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."
CVE-2016-7223	Microsoft Windows Server 2012	Med	0.40	6.1	0.01	Nov 10, 2016	Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka…
CVE-2016-3388	Microsoft Internet Explorer	Med	0.40	5.3	0.28	Oct 14, 2016	Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a different vulnerability than…
CVE-2016-0070	Microsoft Windows	Med	0.40	5.5	0.11	Oct 14, 2016	The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call…
CVE-2016-3379	Microsoft Exchange Server	Med	0.40	6.1	0.08	Sep 14, 2016	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
CVE-2016-3373	Microsoft Windows	Med	0.40	5.5	0.17	Sep 14, 2016	The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 does not properly implement registry access control, which allows local users to…
CVE-2016-3212	Microsoft Internet Explorer	Med	0.40	6.1	0.10	Jun 16, 2016	The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."
CVE-2016-0039	Microsoft Sharepoint Foundation	Med	0.40	6.1	0.06	Feb 10, 2016	Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
CVE-2016-0032	Microsoft Exchange Server	Med	0.40	6.1	0.08	Jan 13, 2016	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing…
CVE-2016-0031	Microsoft Exchange Server	Med	0.40	6.1	0.08	Jan 13, 2016	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.
CVE-2016-0030	Microsoft Exchange Server	Med	0.40	6.1	0.08	Jan 13, 2016	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVE-2016-0029	Microsoft Exchange Server	Med	0.40	6.1	0.08	Jan 13, 2016	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.

CVE-2019-0870MedApr 9, 2019
Microsoft
Team Foundation Server
risk 0.40cvss 6.1epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0869MedApr 9, 2019
Microsoft
Azure Devops Server
risk 0.40cvss 6.1epss 0.02
A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.
CVE-2019-0868MedApr 9, 2019
Microsoft
Team Foundation Server
risk 0.40cvss 6.1epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0867MedApr 9, 2019
Microsoft
Team Foundation Server
risk 0.40cvss 6.1epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866,…
CVE-2019-0866MedApr 9, 2019
Microsoft
Team Foundation Server
risk 0.40cvss 6.1epss 0.03
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867,…
CVE-2019-0858MedApr 9, 2019
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.02
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
CVE-2019-0798MedApr 9, 2019
Microsoft
Lync Server
risk 0.40cvss 6.1epss 0.02
A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.
CVE-2019-0670MedMar 5, 2019
Microsoft
Sharepoint Server
risk 0.40cvss 6.1epss 0.02
A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerability'.
CVE-2019-0635MedMar 5, 2019
Microsoft
Windows Hyper-V
risk 0.40cvss 6.2epss 0.02
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVE-2018-8600MedNov 14, 2018
Microsoft
Azure App Service
risk 0.40cvss 6.1epss 0.02
A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App.
CVE-2018-8470MedSep 13, 2018
Microsoft
Internet Explorer
risk 0.40cvss 6.1epss 0.03
A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.
CVE-2018-8437MedSep 13, 2018
Microsoft
Hyper-V Network Switch
risk 0.40cvss 6.2epss 0.02
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-8436MedSep 13, 2018
Microsoft
Hyper-V Network Switch
risk 0.40cvss 6.2epss 0.02
A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-8278MedJul 11, 2018
Microsoft
Edge
risk 0.40cvss 6.1epss 0.06
A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge.
CVE-2018-8239MedJun 14, 2018
Microsoft
Windows Server 2016
risk 0.40cvss 5.5epss 0.58
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVE-2018-0964MedApr 12, 2018
Microsoft
Hyper-V
risk 0.40cvss 6.1epss 0.02
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This affects Windows 10, Windows 10…
CVE-2018-0908MedFeb 26, 2018
Microsoft
Identity Manager
risk 0.40cvss 6.1epss 0.02
Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a specially crafted attribute value being displayed to a user on an affected MIM 2016 server, aka "Microsoft Identity Manager XSS Elevation of Privilege…
CVE-2018-0799MedJan 10, 2018
Microsoft
Access
risk 0.40cvss 6.1epss 0.04
Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scripting (XSS) vulnerability due to the way image field values are handled, aka "Microsoft Access Tampering Vulnerability".
CVE-2017-11863MedNov 15, 2017
Microsoft
Edge
risk 0.40cvss 6.1epss 0.03
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user into loading a page containing malicious content, due to how the Edge Content Security Policy (CSP) validates documents,…
CVE-2017-8758MedSep 13, 2017
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.03
Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
CVE-2017-8683MedSep 13, 2017
Microsoft
Windows Server 2008
risk 0.40cvss 5.5epss 0.23
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded…
CVE-2017-8642MedAug 8, 2017
Microsoft
Edge
risk 0.40cvss 6.1epss 0.03
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
CVE-2017-8621MedJul 11, 2017
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.03
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
CVE-2017-8560MedJul 11, 2017
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.03
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site…
CVE-2017-8559MedJul 11, 2017
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.03
Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site…
CVE-2017-8551MedJun 15, 2017
Microsoft
Project Server
risk 0.40cvss 6.1epss 0.03
An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".
CVE-2017-8550MedJun 15, 2017
Microsoft
Skype For Business
risk 0.40cvss 5.4epss 0.22
A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".
CVE-2017-8537MedMay 26, 2017
Microsoft
Exchange Server
risk 0.40cvss 5.5epss 0.17
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-8536MedMay 26, 2017
Microsoft
Exchange Server
risk 0.40cvss 5.5epss 0.17
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-8535MedMay 26, 2017
Microsoft
Exchange Server
risk 0.40cvss 5.5epss 0.17
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server…
CVE-2017-0211MedApr 12, 2017
Microsoft
Windows Server 2012
risk 0.40cvss 5.5epss 0.14
An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka "Windows OLE Elevation of Privilege…
CVE-2017-0110MedMar 17, 2017
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.07
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."
CVE-2017-0107MedMar 17, 2017
Microsoft
Sharepoint Server
risk 0.40cvss 6.1epss 0.07
Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."
CVE-2017-0060MedMar 17, 2017
Microsoft
Windows
risk 0.40cvss 5.5epss 0.16
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from…
CVE-2017-0016MedMar 17, 2017
Microsoft
Windows Server 2012
risk 0.40cvss 5.9epss 0.26
Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets, which allows remote attackers to execute arbitrary code via a crafted SMBv2 or SMBv3 packet…
CVE-2016-7282MedDec 20, 2016
Microsoft
Internet Explorer
risk 0.40cvss 6.1epss 0.10
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2016-7280MedDec 20, 2016
Microsoft
Edge
risk 0.40cvss 6.1epss 0.09
Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.
CVE-2016-7206MedDec 20, 2016
Microsoft
Edge
risk 0.40cvss 6.1epss 0.12
Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7280.
CVE-2016-7251MedNov 10, 2016
Microsoft
SQL Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."
CVE-2016-7223MedNov 10, 2016
Microsoft
Windows Server 2012
risk 0.40cvss 6.1epss 0.01
Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka…
CVE-2016-3388MedOct 14, 2016
Microsoft
Internet Explorer
risk 0.40cvss 5.3epss 0.28
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a different vulnerability than…
CVE-2016-0070MedOct 14, 2016
Microsoft
Windows
risk 0.40cvss 5.5epss 0.11
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call…
CVE-2016-3379MedSep 14, 2016
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
CVE-2016-3373MedSep 14, 2016
Microsoft
Windows
risk 0.40cvss 5.5epss 0.17
The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 does not properly implement registry access control, which allows local users to…
CVE-2016-3212MedJun 16, 2016
Microsoft
Internet Explorer
risk 0.40cvss 6.1epss 0.10
The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."
CVE-2016-0039MedFeb 10, 2016
Microsoft
Sharepoint Foundation
risk 0.40cvss 6.1epss 0.06
Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
CVE-2016-0032MedJan 13, 2016
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing…
CVE-2016-0031MedJan 13, 2016
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.
CVE-2016-0030MedJan 13, 2016
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVE-2016-0029MedJan 13, 2016
Microsoft
Exchange Server
risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.

Page 178 of 314