VYPR
← Microsoft

Vendor CVEs

Microsoft

All CVEs

14,318 total · sorted by risk
  • CVE-2004-0790Apr 12, 2005
    Sun Corporation
    Solaris
    risk 0.09cvss —epss 0.81

    Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on…

  • CVE-2004-1134Jan 10, 2005
    Microsoft
    W3who.dll
    risk 0.09cvss —epss 0.72

    Buffer overflow in the Microsoft W3Who ISAPI (w3who.dll) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long query string.

  • CVE-2004-0567Dec 31, 2004
    Microsoft
    Windows Nt
    risk 0.09cvss —epss 0.72

    The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute…

  • CVE-2004-0206Nov 3, 2004
    Microsoft
    Windows Nt
    risk 0.09cvss —epss 0.77

    Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an…

  • CVE-2004-0230Aug 18, 2004
    Microsoft
    Windows 2000
    risk 0.09cvss —epss 0.81

    TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections,…

  • CVE-2004-0204Aug 6, 2004
    Microsoft
    Outlook
    risk 0.09cvss —epss 0.73

    Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows…

  • CVE-2003-0714Nov 17, 2003
    Microsoft
    Exchange Server
    risk 0.09cvss —epss 0.76

    The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange…

  • CVE-2003-0001Jan 17, 2003
    Linux
    Kernel
    risk 0.09cvss —epss 0.73

    Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.

  • CVE-2002-1142Nov 29, 2002
    Microsoft
    Internet Explorer
    risk 0.09cvss —epss 0.76

    Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.

  • CVE-2002-1123Sep 24, 2002
    Microsoft
    SQL Server
    risk 0.09cvss —epss 0.78

    Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.

  • CVE-2002-0079Apr 22, 2002
    Microsoft
    Internet Information Server
    risk 0.09cvss —epss 0.77

    Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.

  • CVE-2001-0506Sep 20, 2001
    Microsoft
    IIS
    risk 0.09cvss —epss 0.69

    Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.

  • CVE-2000-1089Jan 9, 2001
    Microsoft
    Phone Book Service
    risk 0.09cvss —epss 0.77

    Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the "Phone Book Service Buffer Overflow" vulnerability.

  • CVE-2000-0884Dec 19, 2000
    Microsoft
    IIS
    risk 0.09cvss —epss 0.72

    IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.

  • CVE-2000-0649Jul 13, 2000
    Microsoft
    Internet Information Server
    risk 0.09cvss —epss 0.77

    IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

  • CVE-2000-0302Mar 31, 2000
    Microsoft
    Index Server
    risk 0.09cvss —epss 0.78

    Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL.

  • CVE-2000-0246Mar 30, 2000
    Microsoft
    IIS
    risk 0.09cvss —epss 0.80

    IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.

  • CVE-1999-1011Jul 19, 1999
    Microsoft
    Data Access Components
    risk 0.09cvss —epss 0.77

    The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.

  • CVE-1999-0874Jun 16, 1999
    Microsoft
    IIS
    risk 0.09cvss —epss 0.78

    Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

  • CVE-1999-0256Feb 1, 1998
    Microsoft
    Windows Nt
    risk 0.09cvss —epss 0.72

    Buffer overflow in War FTP allows remote execution of commands.

  • CVE-2015-6133Dec 9, 2015
    Microsoft
    Windows 8
    risk 0.08cvss —epss 0.67

    Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution…

  • CVE-2015-0014Jan 13, 2015
    Microsoft
    Windows
    risk 0.08cvss —epss 0.97

    Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets,…

  • CVE-2014-6321Nov 11, 2014
    Microsoft
    Windows
    risk 0.08cvss —epss 0.96

    Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via crafted packets, aka…

  • CVE-2014-1773Jun 11, 2014
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.63

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1783,…

  • CVE-2013-3205Sep 11, 2013
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.66

    Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3184Aug 14, 2013
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.58

    Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2013-3182Aug 14, 2013
    Microsoft
    Windows Server 2012
    risk 0.08cvss —epss 0.96

    The Windows NAT Driver (aka winnat) service in Microsoft Windows Server 2012 does not properly validate memory addresses during the processing of ICMP packets, which allows remote attackers to cause a denial of service (memory corruption and system hang) via crafted packets, aka…

  • CVE-2012-1876Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.65

    Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote…

  • CVE-2012-1875Jun 12, 2012
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.62

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability."

  • CVE-2012-1459Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.08cvss —epss 1.00

    The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus…

  • CVE-2012-1457Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.08cvss —epss 0.98

    The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1,…

  • CVE-2012-1453Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.08cvss —epss 0.98

    The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly Webwasher) 2010.1C, Emsisoft Anti-Malware 5.1.0.1, CA eTrust Vet Antivirus…

  • CVE-2012-1443Mar 21, 2012
    Trend Micro
    Housecall
    risk 0.08cvss —epss 1.00

    The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft…

  • CVE-2012-1420Mar 21, 2012
    Cat
    Quick Heal
    risk 0.08cvss —epss 0.97

    The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32…

  • CVE-2011-1996Oct 12, 2011
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.60

    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability."

  • CVE-2011-1260Jun 16, 2011
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.61

    Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability."

  • CVE-2011-0654Feb 16, 2011
    Microsoft
    Windows Server 2003
    risk 0.08cvss —epss 0.68

    Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold,…

  • CVE-2010-3970Dec 22, 2010
    Microsoft
    Windows
    risk 0.08cvss —epss 0.68

    Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers…

  • CVE-2010-3332Sep 22, 2010
    Microsoft
    .net Framework
    risk 0.08cvss —epss 0.67

    Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View…

  • CVE-2010-1899Sep 15, 2010
    Microsoft
    Internet Information Server
    risk 0.08cvss —epss 0.57

    Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request…

  • CVE-2010-1681May 6, 2010
    Microsoft
    Visio
    risk 0.08cvss —epss 0.67

    Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.

  • CVE-2010-0480Apr 14, 2010
    Microsoft
    Windows 2000
    risk 0.08cvss —epss 0.68

    Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG…

  • CVE-2010-0478Apr 14, 2010
    Microsoft
    Windows 2000
    risk 0.08cvss —epss 0.67

    Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote attackers to execute arbitrary code via crafted packets associated with transport information, aka "Media Services Stack-based…

  • CVE-2010-0239Feb 10, 2010
    Microsoft
    Windows
    risk 0.08cvss —epss 0.61

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform bounds checking on ICMPv6 Router Advertisement packets, which allows remote attackers to execute arbitrary code via crafted…

  • CVE-2009-2532Oct 14, 2009
    Microsoft
    Windows
    risk 0.08cvss —epss 0.62

    Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in an SMB Multi-Protocol Negotiate Request packet, which allows remote attackers to execute arbitrary code via a crafted SMBv2 packet to the…

  • CVE-2009-1136Jul 15, 2009
    Microsoft
    Office
    risk 0.08cvss —epss 0.62

    The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet…

  • CVE-2009-0133Jan 15, 2009
    Microsoft
    HTML Help Workshop
    risk 0.08cvss —epss 0.67

    Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp file with a long "Index file" field, possibly a related issue to CVE-2006-0564.

  • CVE-2008-4844Dec 11, 2008
    Microsoft
    Internet Explorer
    risk 0.08cvss —epss 0.67

    Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular…

  • CVE-2008-4037Nov 12, 2008
    Microsoft
    Windows 2000
    risk 0.08cvss —epss 0.59

    Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka…

  • CVE-2008-2463Jul 7, 2008
    Microsoft
    Office Snapshot Viewer
    risk 0.08cvss —epss 0.59

    The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document…

Page 201 of 287