[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2015-1635 | 14 Apr 2015 | CVSS 9.8 | Microsoft HTTP.sys Remote Code ExecutionHTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers… | ExploitedFix |
| CVE-2015-0071 | 11 Feb 2015 | CVSS 6.5 | Microsoft Internet Explorer ASLR BypassMicrosoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet… | ExploitedFix |
| CVE-2015-0313 | 2 Feb 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-0311 | 23 Jan 2015 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through… | ExploitedFix |
| CVE-2015-0016 | 13 Jan 2015 | CVSS 7.8 | Microsoft Windows TS WebProxy Directory TraversalDirectory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2… | ExploitedFix |
| CVE-2014-6324 | 18 Nov 2014 | CVSS 8.8 | Microsoft Kerberos Key Distribution Center (KDC) Privilege EscalationThe Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… | ExploitedFix |
| CVE-2014-6332 | 11 Nov 2014 | CVSS 8.8 | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code ExecutionOleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… | ExploitedFix |
| CVE-2014-4077 | 11 Nov 2014 | CVSS 7.8 | Microsoft IME Japanese Privilege EscalationMicrosoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka… | ExploitedFix |
| CVE-2014-6352 | 22 Oct 2014 | CVSS 7.8 | Microsoft Windows Code InjectionMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows… | ExploitedFix |
| CVE-2014-4123 | 15 Oct 2014 | CVSS 8.8 | Microsoft Internet Explorer Privilege EscalationMicrosoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of… | ExploitedFix |
| CVE-2014-4148 | 15 Oct 2014 | CVSS 8.8 | Microsoft Windows Remote Code Executionwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… | ExploitedFix |
| CVE-2014-4113 | 15 Oct 2014 | CVSS 7.8 | Microsoft Win32k Privilege Escalationwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1… | ExploitedFix |
| CVE-2014-4114 | 15 Oct 2014 | CVSS 7.8 | Microsoft Windows Object Linking & Embedding (OLE) Remote Code ExecutionMicrosoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows… | ExploitedFix |
| CVE-2014-2817 | 12 Aug 2014 | CVSS 8.8 | Microsoft Internet Explorer Privilege EscalationMicrosoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of… | ExploitedFix |
| CVE-2014-1812 | 14 May 2014 | CVSS 8.8 | Microsoft Windows Group Policy Preferences Password Privilege EscalationThe Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and… | ExploitedFix |
| CVE-2014-1776 | 27 Apr 2014 | CVSS 9.8 | Microsoft Internet Explorer Memory CorruptionUse-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of… | ExploitedFix |
| CVE-2014-1761 | 25 Mar 2014 | CVSS 7.8 | Microsoft Word Memory CorruptionMicrosoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word… | ExploitedFix |
| CVE-2013-7331 | 26 Feb 2014 | CVSS 6.5 | Microsoft Internet Explorer Information DisclosureThe Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC… | ExploitedFix |
| CVE-2014-0322 | 14 Feb 2014 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted… | ExploitedFix |
| CVE-2013-3900 | 11 Dec 2013 | CVSS 5.5 | Microsoft WinVerifyTrust function Remote Code ExecutionWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table… | ExploitedFix |
| CVE-2013-5065 | 28 Nov 2013 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationNDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as… | ExploitedFix |
| CVE-2013-3918 | 12 Nov 2013 | CVSS 8.8 | Microsoft Windows Out-of-Bounds WriteThe InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2… | ExploitedFix |
| CVE-2013-3906 | 6 Nov 2013 | CVSS 7.8 | Microsoft Graphics Component Memory CorruptionGDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync… | ExploitedFix |
| CVE-2013-3897 | 9 Oct 2013 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to… | ExploitedFix |
| CVE-2013-3896 | 9 Oct 2013 | CVSS 5.5 | Microsoft Silverlight Information DisclosureMicrosoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers… | ExploitedFix |
| CVE-2013-3893 | 18 Sep 2013 | CVSS 8.8 | Microsoft Internet Explorer Resource Management ErrorsUse-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers… | Exploited |
| CVE-2013-3163 | 10 Jul 2013 | CVSS 8.8 | Microsoft Internet Explorer Memory CorruptionMicrosoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… | ExploitedFix |
| CVE-2013-1331 | 12 Jun 2013 | CVSS 7.8 | Microsoft Office Buffer OverflowBuffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an… | ExploitedFix |
| CVE-2013-3660 | 24 May 2013 | CVSS 7.8 | Microsoft Win32k Privilege EscalationThe EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows… | ExploitedFix |
| CVE-2013-1347 | 5 May 2013 | CVSS 8.8 | Microsoft Internet Explorer Remote Code ExecutionMicrosoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an… | ExploitedFix |
| CVE-2013-0074 | 13 Mar 2013 | CVSS 7.8 | Microsoft Silverlight Double DereferenceMicrosoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows… | ExploitedFix |
| CVE-2013-2551 | 11 Mar 2013 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site… | ExploitedFix |
| CVE-2012-4792 | 30 Dec 2012 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that… | ExploitedFix |
| CVE-2012-4792 | 30 Dec 2012 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that… | ExploitedFix |
| CVE-2012-2539 | 12 Dec 2012 | CVSS 7.8 | Microsoft Word Remote Code ExecutionMicrosoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow… | ExploitedFix |
| CVE-2012-4969 | 18 Sep 2012 | CVSS 8.1 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to… | ExploitedFix |
| CVE-2012-1856 | 15 Aug 2012 | CVSS 8.8 | Microsoft Office MSCOMCTL.OCX Remote Code ExecutionThe TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and… | ExploitedFix |
| CVE-2012-1854 | 10 Jul 2012 | CVSS 7.8 | Microsoft Visual Basic for Applications Insecure Library LoadingUntrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for… | Exploited |
| CVE-2012-1889 | 13 Jun 2012 | CVSS 8.8 | Microsoft XML Core Services Memory CorruptionMicrosoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code… | ExploitedFix |
| CVE-2012-0151 | 10 Apr 2012 | CVSS 7.8 | Microsoft Windows Authenticode Signature Verification Remote Code ExecutionThe Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… | ExploitedFix |
| CVE-2012-0158 | 10 Apr 2012 | CVSS 8.8 | Microsoft MSCOMCTL.OCX Remote Code ExecutionThe (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003… | ExploitedFix |
| CVE-2011-3402 | 4 Nov 2011 | CVSS 8.8 | Microsoft Windows Remote Code ExecutionUnspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows… | Exploited |
| CVE-2011-2005 | 12 Oct 2011 | CVSS 7.8 | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validationafd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to… | ExploitedFix |
| CVE-2011-1889 | 16 Jun 2011 | CVSS 9.8 | Microsoft Forefront TMG Remote Code ExecutionThe NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute… | ExploitedFix |
| CVE-2010-4398 | 6 Dec 2010 | CVSS 7.8 | Microsoft Windows Kernel Stack-Based Buffer OverflowStack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2… | ExploitedFix |
| CVE-2010-3333 | 10 Nov 2010 | CVSS 7.8 | Microsoft Office Stack-based Buffer OverflowStack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac… | ExploitedFix |
| CVE-2010-2572 | 10 Nov 2010 | CVSS 7.8 | Microsoft PowerPoint Buffer OverflowBuffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document… | ExploitedFix |
| CVE-2010-3962 | 5 Nov 2010 | CVSS 8.1 | Microsoft Internet Explorer Uninitialized Memory CorruptionUse-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to… | ExploitedFix |
| CVE-2010-2568 | 22 Jul 2010 | CVSS 7.8 | Microsoft Windows Remote Code ExecutionWindows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote… | ExploitedFix |
| CVE-2010-0806 | 10 Mar 2010 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers… | ExploitedFix |
| CVE-2010-0232 | 21 Jan 2010 | CVSS 7.8 | Microsoft Windows Kernel Exception HandlerThe kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista… | ExploitedFix |
| CVE-2010-0249 | 15 Jan 2010 | CVSS 8.8 | Microsoft Internet Explorer Use-After-FreeUse-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2… | ExploitedFix |
| CVE-2009-3129 | 11 Nov 2009 | CVSS 7.8 | Microsoft Excel Featheader Record Memory CorruptionMicrosoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel… | ExploitedFix |
| CVE-2008-0015 | 7 Jul 2009 | CVSS 8.8 | Microsoft Windows Video ActiveX Control Remote Code ExecutionStack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX… | Exploited |
| CVE-2009-0557 | 10 Jun 2009 | CVSS 7.8 | Microsoft Office Object Record CorruptionExcel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and… | ExploitedFix |
| CVE-2009-1123 | 10 Jun 2009 | CVSS 7.8 | Microsoft Windows Improper Input ValidationThe kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate… | ExploitedFix |
| CVE-2009-0563 | 10 Jun 2009 | CVSS 7.8 | Microsoft Office Buffer OverflowStack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File… | ExploitedFix |
| CVE-2009-1537 | 29 May 2009 | CVSS 8.8 | Microsoft DirectX NULL Byte OverwriteUnspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4… | ExploitedFix |
| CVE-2009-0556 | 3 Apr 2009 | CVSS 8.8 | Microsoft Office PowerPoint Code InjectionMicrosoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute… | ExploitedFix |
| CVE-2009-0238 | 25 Feb 2009 | CVSS 8.8 | Microsoft Office Remote Code ExecutionMicrosoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel… | Exploited |
| CVE-2008-4250 | 23 Oct 2008 | CVSS 9.8 | Microsoft Windows Buffer OverflowThe Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows… | ExploitedFix |
| CVE-2007-0671 | 3 Feb 2007 | CVSS 8.8 | Microsoft Office Excel Remote Code ExecutionUnspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted… | Exploited |
| CVE-2006-2492 | 20 May 2006 | CVSS 8.8 | Microsoft Word Malformed Object PointerBuffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows… | ExploitedFix |
| CVE-2004-0210 | 6 Aug 2004 | CVSS 7.8 | Microsoft Windows Privilege EscalationThe POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by… | ExploitedFix |
| CVE-2002-0367 | 25 Jun 2002 | CVSS 7.8 | Microsoft Windows Privilege Escalationsmss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows… | ExploitedFix |
Page 19 of 19