Microsoft

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network.

Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network.

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path traversal sequences in…

Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.

Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.

Azure Function Information Disclosure Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.

Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use…

Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation,…

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.