CVE Vulnerability Catalog

A vulnerability in Active Directory Federation Services (AD FS) related to improper certificate validation allows an unauthorized attacker to perform spoofing over a network.

A code injection vulnerability in Windows Assigned Access allows an authorized attacker to elevate privileges locally.

An out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. The flaw occurs when data is written outside the allocated memory area.

Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.

A heap-based buffer overflow vulnerability in Windows NTFS allows an authorized attacker to elevate privileges locally.

A use-after-free vulnerability in Windows Kernel allows an authorized attacker to elevate privileges locally.

A race condition vulnerability in Windows Autopilot arises from improper synchronization when accessing a shared resource. An authenticated attacker can exploit this flaw to elevate privileges locally.

An out-of-bounds read vulnerability in Windows Network File System allows an authenticated attacker to elevate privileges locally. The flaw stems from improper reading of data beyond buffer boundaries.

A use of uninitialized resource vulnerability in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

A server-side request forgery (SSRF) vulnerability in Azure Arc allows an authorized attacker to elevate privileges over a network.

A heap-based buffer overflow vulnerability in Windows Raw Image Extension allows an unauthenticated attacker to execute code remotely over a network. The flaw occurs due to buffer overflow on the heap during image processing.

A vulnerability involving external control of system or configuration settings in Microsoft PowerToys allows an authenticated attacker to elevate privileges locally. The flaw enables configuration manipulation by an unauthorized source.

A deserialization of untrusted data vulnerability in Microsoft Windows Media Foundation allows an authenticated attacker to elevate privileges locally. The flaw arises from unsafe deserialization of untrusted data.

Missing authentication for a critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.

An out-of-bounds read vulnerability in Windows Graphics Kernel allows an authenticated attacker to elevate privileges locally. The flaw stems from improper reading of data beyond buffer boundaries in the graphics kernel.

A heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper memory handling during DNS query processing.

A use after free vulnerability in Desktop Window Manager allows an authenticated attacker to elevate privileges locally. The flaw arises from the use of freed memory.

A heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper handling of media data.

A heap-based buffer overflow vulnerability in Windows Media allows an unauthenticated attacker to execute code remotely over a network. The flaw occurs due to buffer overflow on the heap during media processing.

A vulnerability with no assigned CWE in Microsoft Office SharePoint allows an authenticated attacker to elevate privileges over a network. The flaw enables privilege escalation within the SharePoint environment.