CVE Vulnerability Catalog

A use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.

A use-after-free vulnerability in various versions of Microsoft Excel and Excel Viewer allows remote attackers to execute arbitrary code by manipulating the fileVersion element in an Office document.

Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document.

A use-after-free vulnerability in Microsoft Excel allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document.

The kernel in Microsoft Windows 8, 8.1, Server 2012, and 10 allows local users to gain elevated privileges via a crafted application, known as 'Windows Object Reference Elevation of Privilege Vulnerability.'

The kernel in various versions of Windows mishandles junctions during mountpoint creation, allowing local users to gain elevated privileges by leveraging certain sandbox access.

The kernel in Microsoft Windows 8, 8.1, Server 2012, and 10 allows physically proximate attackers to bypass the Trusted Boot protection mechanism, potentially compromising the integrity of code and features like BitLocker and Device Encryption.

The kernel in various versions of Windows allows local users to gain elevated privileges via a crafted application, known as 'Windows Elevation of Privilege Vulnerability.'

The kernel in various versions of Windows allows local users to gain elevated privileges via a crafted application, known as 'Windows Kernel Memory Corruption Vulnerability.'

A use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site.

A use-after-free vulnerability in Windows Shell in various versions of Microsoft Windows allows remote attackers to execute arbitrary code via a crafted toolbar object.

The VBScript 5.7 and 5.8 and JScript 5.7 and 5.8 engines in Internet Explorer 8 through 11 and other Microsoft products allow remote attackers to execute arbitrary code or cause a denial of service via a crafted replace operation with a JavaScript regular expression.

Cisco Aironet 1850 access points with software 8.1(112.4) allow local users to gain privileges via crafted CLI commands.

The RSS Reader component in Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.

Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 allow remote authenticated users to execute arbitrary PHP code via unspecified vectors.

The JMX RMI service in VMware vCenter Server in versions 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, allowing remote attackers to execute arbitrary code via the RMI protocol.

EMC RSA Web Threat Detection before 5.1 SP1 allows local users to obtain root privileges by leveraging access to a service account and writing commands to a service configuration file.

The object-observe.js file in Google V8, used in Google Chrome before version 45.0.2454.101, does not properly restrict method calls on access-checked objects. This allows remote attackers to bypass the Same Origin Policy via observe or getNotifier calls.

In Blink, used in Google Chrome before version 45.0.2454.101, there is a vulnerability that does not perform a rethrow action to propagate information about cross-context exceptions. This allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.

Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.