VYPR
← Microsoft

Vendor CVEs

Microsoft

All CVEs

15,658 total · sorted by risk
  • CVE-2019-0841HigKEVApr 9, 2019
    Microsoft
    Windows AppX Deployment Service
    risk 0.75cvss 7.8epss 0.41

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

  • CVE-2018-8414HigKEVAug 15, 2018
    Microsoft
    Windows Shell
    risk 0.75cvss 8.8epss 0.74

    A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

  • CVE-2017-0213HigKEVMay 12, 2017
    Microsoft
    Windows Server 2008
    risk 0.75cvss 7.3epss 0.84

    Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an…

  • CVE-2016-0099HigKEVMar 9, 2016
    Microsoft
    Windows
    risk 0.75cvss 7.8epss 0.37

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain…

  • CVE-2010-3962HigKEVNov 5, 2010
    Microsoft
    Internet Explorer
    risk 0.75cvss 8.1epss 0.97

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory…

  • CVE-2009-0556HigKEVApr 3, 2009
    Microsoft
    Powerpoint
    risk 0.75cvss 8.8epss 0.68

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption,…

  • CVE-2023-21554CriApr 11, 2023
    Microsoft
    Message Queuing
    risk 0.74cvss 9.8epss 0.95

    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  • CVE-2022-21907CriJan 11, 2022
    Microsoft
    HTTP Protocol Stack
    risk 0.74cvss 9.8epss 0.93

    HTTP Protocol Stack Remote Code Execution Vulnerability

  • CVE-2020-1020HigKEVApr 15, 2020
    Microsoft
    Windows
    risk 0.74cvss 8.8epss 0.65

    A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the…

  • CVE-2019-1405HigKEVNov 12, 2019
    Microsoft
    Windows Universal Plug and Play (UPnP) service
    risk 0.74cvss 7.8epss 0.30

    An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

  • CVE-2017-0037HigKEVFeb 26, 2017
    Microsoft
    Internet Explorer
    risk 0.74cvss 8.1epss 0.80

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted…

  • CVE-2016-7256HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.74cvss 8.8epss 0.65

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute…

  • CVE-2012-4969HigKEVSep 18, 2012
    Microsoft
    Internet Explorer
    risk 0.74cvss 8.1epss 0.82

    Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.

  • CVE-2012-1856HigKEVAug 15, 2012
    Microsoft
    Office
    risk 0.74cvss 8.8epss 0.72

    The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server…

  • CVE-2024-43461HigKEVSep 10, 2024
    Microsoft
    MSHTML Platform
    risk 0.73cvss 8.8epss 0.54

    Windows MSHTML Platform Spoofing Vulnerability

  • CVE-2024-29988HigKEVApr 9, 2024
    Microsoft
    SmartScreen Prompt
    risk 0.73cvss 8.8epss 0.45

    SmartScreen Prompt Security Feature Bypass Vulnerability

  • CVE-2023-21674HigKEVJan 10, 2023
    Microsoft
    Windows
    risk 0.73cvss 8.8epss 0.42

    Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

  • CVE-2021-42287HigKEVNov 10, 2021
    Microsoft
    Windows Server 2003
    risk 0.73cvss 7.5epss 0.76

    Active Directory Domain Services Elevation of Privilege Vulnerability

  • CVE-2020-1147HigKEVJul 14, 2020
    Microsoft
    Visual Studio
    risk 0.73cvss 7.8epss 0.94

    A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

  • CVE-2020-0609CriJan 14, 2020
    Microsoft
    Windows Remote Desktop Gateway
    risk 0.73cvss 9.8epss 0.75

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…

  • CVE-2019-1322HigKEVOct 10, 2019
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.19

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.

  • CVE-2019-1253HigKEVSep 11, 2019
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.12

    An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID…

  • CVE-2019-1215HigKEVSep 11, 2019
    Microsoft
    Winsock
    risk 0.73cvss 7.8epss 0.19

    An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.

  • CVE-2018-8440HigKEVSep 13, 2018
    Microsoft
    Windows Server 2008
    risk 0.73cvss 7.8epss 0.18

    An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows…

  • CVE-2017-8759HigKEVSep 13, 2017
    Microsoft
    .net Framework
    risk 0.73cvss 7.8epss 0.89

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code Execution Vulnerability."

  • CVE-2017-8570HigKEVJul 11, 2017
    Microsoft
    Office
    risk 0.73cvss 7.8epss 0.90

    Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.

  • CVE-2016-3309HigKEVAug 9, 2016
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.21

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3236CriJun 16, 2016
    Microsoft
    Windows
    risk 0.73cvss 9.8epss 0.77

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows…

  • CVE-2015-2502HigKEVAug 19, 2015
    Microsoft
    Internet Explorer
    risk 0.73cvss 8.8epss 0.51

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.

  • CVE-2015-2425HigKEVJul 14, 2015
    Microsoft
    Internet Explorer
    risk 0.73cvss 8.8epss 0.45

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.

  • CVE-2014-4148HigKEVOct 15, 2014
    Microsoft
    Windows
    risk 0.73cvss 8.8epss 0.60

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary…

  • CVE-2014-4113HigKEVOct 15, 2014
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.87

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a…

  • CVE-2010-3333HigKEVNov 10, 2010
    Microsoft
    Office
    risk 0.73cvss 7.8epss 0.90

    Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF…

  • CVE-2010-2568HigKEVJul 22, 2010
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.91

    Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon…

  • CVE-2009-3129HigKEVNov 11, 2009
    Microsoft
    Office
    risk 0.73cvss 7.8epss 0.86

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats…

  • CVE-2009-1537HigKEVMay 29, 2009
    Microsoft
    Windows 2000
    risk 0.73cvss 8.8epss 0.51

    Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime…

  • CVE-2009-0238HigKEVFeb 25, 2009
    Microsoft
    Office
    risk 0.73cvss 8.8epss 0.43

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute…

  • CVE-2007-0671HigKEVFeb 3, 2007
    Microsoft
    Office
    risk 0.73cvss 8.8epss 0.42

    Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

  • CVE-2006-2492HigKEVMay 20, 2006
    Microsoft
    Office
    risk 0.73cvss 8.8epss 0.48

    Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a…

  • CVE-2004-0847CriNov 3, 2004
    Microsoft
    Asp.net
    risk 0.73cvss 9.8epss 0.76

    The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."

  • CVE-2023-4762HigKEVSep 5, 2023
    Google
    Chrome
    risk 0.72cvss 8.8epss 0.40

    Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

  • CVE-2021-42278HigKEVNov 10, 2021
    Microsoft
    Windows Server 2003
    risk 0.72cvss 7.5epss 0.72

    Active Directory Domain Services Elevation of Privilege Vulnerability

  • CVE-2021-31207MedKEVMay 11, 2021
    Microsoft
    Exchange Server
    risk 0.72cvss 6.6epss 1.00

    Microsoft Exchange Server Security Feature Bypass Vulnerability

  • CVE-2020-0610CriJan 14, 2020
    Microsoft
    Windows Remote Desktop Gateway
    risk 0.72cvss 9.8epss 0.68

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…

  • CVE-2019-0543HigKEVJan 8, 2019
    Microsoft
    Windows Server 2008
    risk 0.72cvss 7.8epss 0.05

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows…

  • CVE-2018-8120HigKEVMay 9, 2018
    Microsoft
    Windows Server 2008
    risk 0.72cvss 7.0epss 0.74

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from…

  • CVE-2017-0222HigKEVMay 12, 2017
    Microsoft
    Internet Explorer
    risk 0.72cvss 8.8epss 0.30

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.

  • CVE-2017-0149HigKEVMar 17, 2017
    Microsoft
    Internet Explorer
    risk 0.72cvss 8.8epss 0.29

    Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in…

  • CVE-2016-7255HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.72cvss 7.8epss 0.81

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted…

  • CVE-2016-7201HigKEVNov 10, 2016
    Microsoft
    Edge
    risk 0.72cvss 8.8epss 0.80

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

Page 3 of 314