VYPR
← Microsoft

Vendor CVEs

Microsoft

All CVEs

18,136 total · sorted by risk
  • CVE-2008-0083Apr 8, 2008
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.30

    The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2008-1086Apr 8, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.31

    The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and SP2, Vista SP1, and Server 2008, allows remote attackers to execute arbitrary code via malformed arguments, which triggers memory…

  • CVE-2008-1544Mar 28, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request…

  • CVE-2008-1092Mar 25, 2008
    Microsoft
    Word
    risk 0.02cvss —epss 0.26

    Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a crafted Word file, as exploited in the wild in March 2008. NOTE: as of 20080513, Microsoft has stated that this is the same issue as…

  • CVE-2008-0951Mar 24, 2008
    Microsoft
    Windows
    risk 0.02cvss —epss 0.30

    Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and possibly physically proximate attackers, to execute arbitrary code by inserting a (1) CD-ROM device or (2) U3-enabled USB device containing a…

  • CVE-2007-1201Mar 11, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption, aka "Office Web Components DataSource Vulnerability."

  • CVE-2008-0103Feb 13, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.30

    Unspecified vulnerability in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Office document that contains a malformed object, related to a "memory handling error," aka "Microsoft Office…

  • CVE-2008-0078Feb 12, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via a crafted image, aka "Argument Handling Memory Corruption Vulnerability."

  • CVE-2008-0076Feb 12, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via crafted HTML layout combinations, aka "HTML Rendering Memory Corruption Vulnerability."

  • CVE-2008-0104Feb 12, 2008
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, aka "Publisher Memory Corruption Vulnerability."

  • CVE-2008-0109Feb 12, 2008
    Microsoft
    Word
    risk 0.02cvss —epss 0.31

    Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code via crafted fields within the File Information Block (FIB) of a Word file, which triggers length calculation errors and memory corruption.

  • CVE-2008-0088Feb 12, 2008
    Microsoft
    Windows 2000
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM) on XP and Server 2003, allows remote attackers to cause a denial of service (hang and restart) via a crafted LDAP request.

  • CVE-2008-0454Jan 25, 2008
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.25

    Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1)…

  • CVE-2008-0235Jan 11, 2008
    Microsoft
    VFP_OLE_Server
    risk 0.02cvss —epss 0.29

    The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.

  • CVE-2007-6250Jan 9, 2008
    AOL
    Aolmediaplaybackcontrol
    risk 0.02cvss —epss 0.26

    Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might allow remote attackers to execute arbitrary code via the AppendFileToPlayList method.

  • CVE-2007-5344Dec 12, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that creates, modifies, deletes, and accesses document objects using the tags property, which triggers heap corruption, related to uninitialized or…

  • CVE-2007-5347Dec 12, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects," aka "DHTML Object Memory Corruption Vulnerability."

  • CVE-2007-3751Nov 7, 2007
    Apple Inc.
    Quicktime
    risk 0.02cvss —epss 0.26

    Unspecified vulnerability in QuickTime for Java in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via untrusted Java applets that gain privileges via unspecified vectors.

  • CVE-2007-5456Oct 14, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' (question mark) followed by a non-.exe filename after the .exe filename, as demonstrated by (1) .txt,…

  • CVE-2007-3893Oct 9, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.24

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified vectors involving memory corruption from an unhandled error.

  • CVE-2007-3892Oct 9, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.26

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecified vectors, a different issue than CVE-2007-1091 and CVE-2007-3826.

  • CVE-2007-3899Oct 9, 2007
    Microsoft
    Word
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string in a Word file, aka "Word Memory Corruption Vulnerability."

  • CVE-2007-5020Sep 21, 2007
    Adobe Inc.
    Acrobat
    risk 0.02cvss —epss 0.20

    Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file, related to the mailto: option and Internet Explorer 7 on Windows XP. NOTE: this information is based upon a vague pre-advisory by a…

  • CVE-2007-3891Aug 14, 2007
    Microsoft
    Windows
    risk 0.02cvss —epss 0.25

    Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HTML attributes.

  • CVE-2007-3032Aug 14, 2007
    Microsoft
    Windows
    risk 0.02cvss —epss 0.25

    Unspecified vulnerability in Windows Vista Contacts Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code via crafted contact information that is not properly handled when it is imported.

  • CVE-2007-3033Aug 14, 2007
    Microsoft
    Windows
    risk 0.02cvss —epss 0.28

    Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are…

  • CVE-2007-3041Aug 14, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.29

    Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arbitrary code via unknown vectors related to Microsoft Visual Basic 6 objects and memory corruption, aka "ActiveX Object Memory Corruption…

  • CVE-2007-3037Aug 14, 2007
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.22

    Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that causes a size mismatch between compressed and decompressed data and triggers a heap-based buffer overflow, aka…

  • CVE-2007-0943Aug 14, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.27

    Unspecified vulnerability in Internet Explorer 5.01 and 6 SP1 allows remote attackers to execute arbitrary code via crafted Cascading Style Sheets (CSS) strings that trigger memory corruption during parsing, related to use of out-of-bounds pointers.

  • CVE-2007-3035Aug 14, 2007
    Microsoft
    Windows Media Player
    risk 0.02cvss —epss 0.25

    Unspecified vulnerability in Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafted header information that is not properly handled during decompression, aka "Windows Media Player Code…

  • CVE-2007-3890Aug 14, 2007
    Microsoft
    Office
    risk 0.02cvss —epss 0.29

    Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary code via a Workspace with a certain index value that triggers memory corruption.

  • CVE-2007-2927Aug 8, 2007
    Atheros
    802.11 a/b/g wireless adapter drivers
    risk 0.02cvss —epss 0.26

    Unspecified vulnerability in Atheros 802.11 a/b/g wireless adapter drivers before 5.3.0.35, and 6.x before 6.0.3.67, on Windows allows remote attackers to cause a denial of service via a crafted 802.11 management frame.

  • CVE-2007-4041Jul 27, 2007
    Mozilla Corporation
    Firefox
    risk 0.02cvss —epss 0.20

    Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to…

  • CVE-2007-3930Jul 21, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Interpretation conflict between Microsoft Internet Explorer and DocuWiki before 2007-06-26b allows remote attackers to inject arbitrary JavaScript and conduct cross-site scripting (XSS) attacks when spellchecking UTF-8 encoded messages via the spell_utf8test function in…

  • CVE-2007-3826Jul 17, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.29

    Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via repeated document.open function calls after a user requests a new page, but before the onBeforeUnload…

  • CVE-2007-0043Jul 10, 2007
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.31

    The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow,…

  • CVE-2007-3030Jul 10, 2007
    Microsoft
    Excel
    risk 0.02cvss —epss 0.25

    Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file involving the "denoting [of] the start of a Workspace designation", which results in memory corruption, aka the "Workbook…

  • CVE-2007-0041Jul 10, 2007
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.31

    The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.

  • CVE-2007-3029Jul 10, 2007
    Microsoft
    Excel
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Excel 2002 SP3 and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file containing multiple active worksheets, which results in memory corruption.

  • CVE-2007-3550Jul 3, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone…

  • CVE-2007-2227Jun 12, 2007
    Microsoft
    Outlook Express
    risk 0.02cvss —epss 0.25

    The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition…

  • CVE-2007-2225Jun 12, 2007
    Microsoft
    Outlook Express
    risk 0.02cvss —epss 0.25

    A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing…

  • CVE-2007-0936Jun 12, 2007
    Microsoft
    Visio
    risk 0.02cvss —epss 0.31

    Multiple unspecified vulnerabilities in Microsoft Visio 2002 allow remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted packed object that triggers memory corruption, aka "Visio Document Packaging Vulnerability."

  • CVE-2007-0934Jun 12, 2007
    Microsoft
    Visio
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Visio 2002 allows remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted version number that triggers memory corruption.

  • CVE-2007-0218Jun 12, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.31

    Microsoft Internet Explorer 5.01 and 6 allows remote attackers to execute arbitrary code by instantiating certain COM objects from Urlmon.dll, which triggers memory corruption during a call to the IObjectSafety function.

  • CVE-2007-1750Jun 12, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via a crafted Cascading Style Sheets (CSS) tag that triggers memory corruption.

  • CVE-2007-3092Jun 6, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 6 allows remote attackers to spoof the URL bar, and page properties including SSL certificates, by interrupting page loading through certain use of location DOM objects and setTimeout calls. NOTE: this issue can be leveraged for phishing and other…

  • CVE-2007-3091Jun 6, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.28

    Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with…

  • CVE-2007-0933Jun 5, 2007
    Microsoft
    Windows Xp
    risk 0.02cvss —epss 0.28

    Buffer overflow in the wireless driver 6.0.0.18 for D-Link DWL-G650+ (Rev. A1) on Windows XP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a beacon frame with a long TIM Information Element.

  • CVE-2007-0946May 8, 2007
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.31

    Unspecified vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote attackers to execute arbitrary code via crafted HTML objects, which results in memory corruption, aka the first of two "HTML Objects…

Page 310 of 363