VYPR
← Microsoft

Vendor CVEs

Microsoft

All CVEs

18,138 total · sorted by risk
  • CVE-2013-1302May 15, 2013
    Microsoft
    Lync
    risk 0.02cvss —epss 0.22

    Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."

  • CVE-2013-0811May 15, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…

  • CVE-2013-0096May 15, 2013
    Microsoft
    Windows Essentials
    risk 0.02cvss —epss 0.31

    Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."

  • CVE-2013-1338May 2, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…

  • CVE-2013-1304Apr 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…

  • CVE-2013-1303Apr 9, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than…

  • CVE-2013-1296Apr 9, 2013
    Microsoft
    Remote Desktop Connection
    risk 0.02cvss —epss 0.21

    The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows…

  • CVE-2013-1282Apr 9, 2013
    Microsoft
    Active Directory Application Mode
    risk 0.02cvss —epss 0.27

    The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD LDS), and Active Directory Services allows remote attackers to cause a denial of service (memory consumption and service outage) via a…

  • CVE-2013-0095Mar 13, 2013
    Microsoft
    Office
    risk 0.02cvss —epss 0.21

    Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the…

  • CVE-2013-0092Mar 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability."

  • CVE-2013-0091Mar 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."

  • CVE-2013-0088Mar 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer saveHistory Use After Free Vulnerability."

  • CVE-2013-0086Mar 13, 2013
    Microsoft
    Onenote
    risk 0.02cvss —epss 0.24

    Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."

  • CVE-2013-0084Mar 13, 2013
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.21

    Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."

  • CVE-2013-0080Mar 13, 2013
    Microsoft
    Sharepoint Server
    risk 0.02cvss —epss 0.19

    Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."

  • CVE-2013-0079Mar 13, 2013
    Microsoft
    Visio
    risk 0.02cvss —epss 0.27

    Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."

  • CVE-2013-1313Feb 13, 2013
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.23

    Object Linking and Embedding (OLE) Automation in Microsoft Windows XP SP3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted RTF document, aka "OLE Automation Remote Code Execution Vulnerability."

  • CVE-2013-1281Feb 13, 2013
    Microsoft
    Windows Server 2008
    risk 0.02cvss —epss 0.24

    The NFS server in Microsoft Windows Server 2008 R2 and R2 SP1 and Server 2012 allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via an attempted renaming of a file or folder located on a read-only share, aka "NULL Dereference…

  • CVE-2013-0077Feb 13, 2013
    Microsoft
    Windows
    risk 0.02cvss —epss 0.30

    Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via crafted media content in (1) a media file, (2) a media stream, or (3) a Microsoft Office document, aka "Media…

  • CVE-2013-0073Feb 13, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.30

    The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during object creation, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser…

  • CVE-2013-0030Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    The Vector Markup Language (VML) implementation in Microsoft Internet Explorer 6 through 10 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via a crafted web site, aka "VML Memory Corruption Vulnerability."

  • CVE-2013-0028Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CObjectElement Use After Free Vulnerability."

  • CVE-2013-0027Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CPasteCommand Use After Free Vulnerability."

  • CVE-2013-0026Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer InsertElement Use After Free Vulnerability."

  • CVE-2013-0024Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer pasteHTML Use After Free Vulnerability."

  • CVE-2013-0021Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer vtable Use After Free Vulnerability."

  • CVE-2013-0020Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkup Use After Free Vulnerability."

  • CVE-2013-0018Feb 13, 2013
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SetCapture Use After Free Vulnerability."

  • CVE-2013-0011Jan 9, 2013
    Microsoft
    Windows Server 2008
    risk 0.02cvss —epss 0.30

    The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted print job, aka "Windows Print Spooler Components Vulnerability."

  • CVE-2013-0004Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.21

    Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-0003Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.24

    Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2013-0002Jan 9, 2013
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET…

  • CVE-2012-4786Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.24

    The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted…

  • CVE-2012-4782Dec 12, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "CMarkup Use After Free Vulnerability."

  • CVE-2012-4774Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted (1) file name or (2) subfolder name that triggers use of unallocated…

  • CVE-2012-2556Dec 12, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to…

  • CVE-2012-1537Dec 12, 2012
    Microsoft
    Directx
    risk 0.02cvss —epss 0.23

    Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows remote attackers to…

  • CVE-2012-4777Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET…

  • CVE-2012-4776Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.25

    The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuration data that is returned during acquisition of proxy settings, which allows remote attackers to execute arbitrary JavaScript code by…

  • CVE-2012-2543Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.26

    Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Stack Overflow Vulnerability."

  • CVE-2012-1896Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.24

    Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application,…

  • CVE-2012-1895Nov 14, 2012
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.23

    The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET…

  • CVE-2012-1887Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.25

    Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SST Invalid Length Use After Free Vulnerability."

  • CVE-2012-1886Nov 14, 2012
    Microsoft
    Excel
    risk 0.02cvss —epss 0.22

    Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Memory Corruption…

  • CVE-2012-1885Nov 14, 2012
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SerAuxErrBar Heap Overflow…

  • CVE-2012-1538Nov 14, 2012
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.21

    Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CFormElement Use After Free Vulnerability."

  • CVE-2012-1528Nov 14, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase,…

  • CVE-2012-1527Nov 14, 2012
    Microsoft
    Windows
    risk 0.02cvss —epss 0.21

    Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase,…

  • CVE-2012-2551Oct 9, 2012
    Microsoft
    Windows Server 2008
    risk 0.02cvss —epss 0.27

    The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted session request, aka "Kerberos NULL Dereference Vulnerability."

  • CVE-2012-2550Oct 9, 2012
    Microsoft
    Works
    risk 0.02cvss —epss 0.22

    Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted Word .doc file, aka "Works Heap Vulnerability."

Page 302 of 363