CVE Database

Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.

Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.

Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a …

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a …

Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Windows WinHTTP allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

Use after free in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.

Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.

Use after free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows CD-ROM Driver allows an unauthorized attacker to execute code with a physical attack.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network.

Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: …

Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.

Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.