Vendor CVEs
Microsoft
All CVEs
18,146 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-38207 | Med | 0.41 | 6.3 | 0.00 | Aug 23, 2024 | Microsoft Edge (HTML-based) Memory Corruption Vulnerability | ||
| CVE-2024-30045 | Med | 0.41 | 6.3 | 0.01 | May 14, 2024 | .NET and Visual Studio Remote Code Execution Vulnerability | ||
| CVE-2024-28898 | Med | 0.41 | 6.3 | 0.01 | Apr 9, 2024 | Secure Boot Security Feature Bypass Vulnerability | ||
| CVE-2024-20675 | Med | 0.41 | 6.3 | 0.00 | Jan 11, 2024 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | ||
| CVE-2023-36869 | Med | 0.41 | 6.3 | 0.01 | Aug 8, 2023 | Azure DevOps Server Spoofing Vulnerability | ||
| CVE-2023-36888 | Med | 0.41 | 6.3 | 0.01 | Jul 14, 2023 | Microsoft Edge for Android (Chromium-based) Tampering Vulnerability | ||
| CVE-2023-33156 | Med | 0.41 | 6.3 | 0.00 | Jul 11, 2023 | Microsoft Defender Elevation of Privilege Vulnerability | ||
| CVE-2022-26899 | Med | 0.41 | 6.3 | 0.01 | Jun 29, 2023 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2023-33132 | Med | 0.41 | 6.3 | 0.01 | Jun 14, 2023 | Microsoft SharePoint Server Spoofing Vulnerability | ||
| CVE-2023-23389 | Med | 0.41 | 6.3 | 0.00 | Mar 14, 2023 | Microsoft Defender Elevation of Privilege Vulnerability | ||
| CVE-2023-21725 | Med | 0.41 | 6.3 | 0.00 | Jan 10, 2023 | Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability | ||
| CVE-2022-24480 | Med | 0.41 | 6.3 | 0.01 | Dec 13, 2022 | Outlook for Android Elevation of Privilege Vulnerability | ||
| CVE-2022-23262 | Med | 0.41 | 6.3 | 0.01 | Feb 7, 2022 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | ||
| CVE-2022-21928 | Med | 0.41 | 6.3 | 0.01 | Jan 11, 2022 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | ||
| CVE-2021-40448 | Med | 0.41 | 6.3 | 0.03 | Sep 15, 2021 | Microsoft Accessibility Insights for Android Information Disclosure Vulnerability | ||
| CVE-2021-36929 | Med | 0.41 | 6.3 | 0.03 | Aug 26, 2021 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | ||
| CVE-2021-34500 | Med | 0.41 | 6.3 | 0.03 | Jul 14, 2021 | Windows Kernel Memory Information Disclosure Vulnerability | ||
| CVE-2021-33755 | Med | 0.41 | 6.3 | 0.03 | Jul 14, 2021 | Windows Hyper-V Denial of Service Vulnerability | ||
| CVE-2020-17085 | Med | 0.41 | 6.2 | 0.04 | Nov 11, 2020 | Microsoft Exchange Server Denial of Service Vulnerability | ||
| CVE-2020-16910 | Med | 0.41 | 6.2 | 0.03 | Oct 16, 2020 | A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location. To exploit this vulnerability, an… | ||
| CVE-2020-1482 | Med | 0.41 | 6.3 | 0.02 | Sep 11, 2020 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to… | ||
| CVE-2020-1440 | Med | 0.41 | 6.3 | 0.02 | Sep 11, 2020 | A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data. To exploit the vulnerability, an attacker would need to be… | ||
| CVE-2019-3588 | Med | 0.41 | 6.3 | 0.00 | Jun 10, 2020 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized users to interact with the On-Access Scan Messages - Threat Alert Window when the Windows Login Screen is locked. | ||
| CVE-2019-1332 | Med | 0.41 | 6.1 | 0.11 | Dec 10, 2019 | A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'. | ||
| CVE-2019-3800 | Med | 0.41 | 6.3 | 0.02 | Aug 5, 2019 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is… | ||
| CVE-2019-0975 | Med | 0.41 | 6.3 | 0.02 | Jul 15, 2019 | A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP… | ||
| CVE-2019-1053 | Med | 0.41 | 6.3 | 0.01 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require… | ||
| CVE-2019-0986 | Med | 0.41 | 6.3 | 0.02 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker… | ||
| CVE-2018-8533 | Med | 0.41 | 5.5 | 0.23 | Oct 10, 2018 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server… | ||
| CVE-2018-8532 | Med | 0.41 | 5.5 | 0.23 | Oct 10, 2018 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server… | ||
| CVE-2018-8527 | Med | 0.41 | 5.5 | 0.23 | Oct 10, 2018 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server… | ||
| CVE-2018-0833 | Med | 0.41 | 5.3 | 0.40 | Feb 15, 2018 | The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vulnerability due to how specially crafted requests are handled, aka "SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability". | ||
| CVE-2017-8683 | Med | 0.41 | 5.5 | 0.23 | Sep 13, 2017 | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded… | ||
| CVE-2017-0061 | Med | 0.41 | 5.3 | 0.43 | Mar 17, 2017 | The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka… | ||
| CVE-2017-0055 | Med | 0.41 | 6.1 | 0.16 | Mar 17, 2017 | Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site… | ||
| CVE-2016-7206 | Med | 0.41 | 6.1 | 0.12 | Dec 20, 2016 | Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7280. | ||
| CVE-2016-3302 | Med | 0.41 | 6.3 | 0.02 | Sep 14, 2016 | Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not properly restrict the loading of web content, which allows physically proximate attackers to execute arbitrary code via a (1) crafted Wi-Fi… | ||
| CVE-2011-1252 | Med | 0.41 | 6.1 | 0.14 | Jun 16, 2011 | Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2,… | ||
| CVE-2026-85916 | Med | 0.40 | 6.2 | 0.00 | Oct 13, 2026 | Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-83500 | Med | 0.40 | 6.1 | 0.00 | Oct 13, 2026 | Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2026-102851 | Med | 0.40 | 6.1 | 0.00 | Oct 13, 2026 | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2026-55946 | Med | 0.40 | 6.1 | 0.00 | Sep 17, 2026 | Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-77490 | Med | 0.40 | 6.1 | 0.00 | Sep 11, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2026-64955 | Med | 0.40 | 6.1 | 0.00 | Aug 12, 2026 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data… | ||
| CVE-2026-66325 | Med | 0.40 | 6.1 | 0.00 | Aug 4, 2026 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2026-66311 | Med | 0.40 | 6.2 | 0.00 | Aug 4, 2026 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. | ||
| CVE-2026-65804 | Med | 0.40 | 6.1 | 0.00 | Aug 4, 2026 | Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2026-58643 | Med | 0.40 | 6.1 | 0.00 | Jul 16, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2026-50420 | Med | 0.40 | 6.2 | 0.00 | Jul 14, 2026 | Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-54988 | Med | 0.40 | 6.1 | 0.00 | Jul 14, 2026 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
- risk 0.41cvss 6.3epss 0.00
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
- risk 0.41cvss 6.3epss 0.01
.NET and Visual Studio Remote Code Execution Vulnerability
- risk 0.41cvss 6.3epss 0.01
Secure Boot Security Feature Bypass Vulnerability
- risk 0.41cvss 6.3epss 0.00
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- risk 0.41cvss 6.3epss 0.01
Azure DevOps Server Spoofing Vulnerability
- risk 0.41cvss 6.3epss 0.01
Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
- risk 0.41cvss 6.3epss 0.00
Microsoft Defender Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Microsoft SharePoint Server Spoofing Vulnerability
- risk 0.41cvss 6.3epss 0.00
Microsoft Defender Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.00
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Outlook for Android Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- risk 0.41cvss 6.3epss 0.01
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- risk 0.41cvss 6.3epss 0.03
Microsoft Accessibility Insights for Android Information Disclosure Vulnerability
- risk 0.41cvss 6.3epss 0.03
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- risk 0.41cvss 6.3epss 0.03
Windows Kernel Memory Information Disclosure Vulnerability
- risk 0.41cvss 6.3epss 0.03
Windows Hyper-V Denial of Service Vulnerability
- risk 0.41cvss 6.2epss 0.04
Microsoft Exchange Server Denial of Service Vulnerability
- risk 0.41cvss 6.2epss 0.03
A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location. To exploit this vulnerability, an…
- risk 0.41cvss 6.3epss 0.02
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to…
- risk 0.41cvss 6.3epss 0.02
A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnerability could modify a targeted user's profile data. To exploit the vulnerability, an attacker would need to be…
- risk 0.41cvss 6.3epss 0.00
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized users to interact with the On-Access Scan Messages - Threat Alert Window when the Windows Login Screen is locked.
- risk 0.41cvss 6.1epss 0.11
A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.
- risk 0.41cvss 6.3epss 0.02
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is…
- risk 0.41cvss 6.3epss 0.02
A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP…
- risk 0.41cvss 6.3epss 0.01
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require…
- risk 0.41cvss 6.3epss 0.02
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker…
- risk 0.41cvss 5.5epss 0.23
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…
- risk 0.41cvss 5.5epss 0.23
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…
- risk 0.41cvss 5.5epss 0.23
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…
- risk 0.41cvss 5.3epss 0.40
The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vulnerability due to how specially crafted requests are handled, aka "SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability".
- risk 0.41cvss 5.5epss 0.23
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an attacker to execute remote code by the way it handles embedded…
- risk 0.41cvss 5.3epss 0.43
The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka…
- risk 0.41cvss 6.1epss 0.16
Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site…
- risk 0.41cvss 6.1epss 0.12
Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7280.
- risk 0.41cvss 6.3epss 0.02
Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607, when the lock screen is enabled, do not properly restrict the loading of web content, which allows physically proximate attackers to execute arbitrary code via a (1) crafted Wi-Fi…
- risk 0.41cvss 6.1epss 0.14
Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2,…
- risk 0.40cvss 6.2epss 0.00
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.1epss 0.00
Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.1epss 0.00
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- risk 0.40cvss 6.1epss 0.00
Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
- risk 0.40cvss 6.1epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.40cvss 6.1epss 0.00
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data…
- risk 0.40cvss 6.1epss 0.00
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.40cvss 6.2epss 0.00
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
- risk 0.40cvss 6.1epss 0.00
Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.40cvss 6.1epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
- risk 0.40cvss 6.2epss 0.00
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.1epss 0.00
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Page 218 of 363