CVE Vulnerability Catalog

A remote code execution vulnerability exists in Microsoft Edge related to the way the Chakra JavaScript engine renders when handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability.'

An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser.

A remote code execution vulnerability exists in Microsoft Edge related to the way JavaScript engines render when handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability.'

A remote code execution vulnerability exists in Microsoft Edge related to errors in the JavaScript engine when handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability.'

A remote code execution vulnerability exists in Microsoft browsers related to the way JavaScript engines handle objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability.'

A remote code execution vulnerability exists in Microsoft Edge related to the way affected Microsoft scripting engines render when handling objects in memory, known as 'Microsoft Edge Memory Corruption Vulnerability.'

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, known as 'Internet Explorer Memory Corruption Vulnerability.'

A remote code execution vulnerability exists in Microsoft Edge due to issues in how JavaScript engines render objects in memory, referred to as 'Scripting Engine Memory Corruption Vulnerability.'

A vulnerability exists when Microsoft Edge improperly accesses objects in memory, known as 'Microsoft Edge Memory Corruption Vulnerability.'

There is a privilege elevation vulnerability in Windows due to improper input validation before loading type libraries. This affects multiple versions of Windows operating systems, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.

Windows Hyper-V contains a vulnerability that allows for elevation of privilege when Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 fail to properly validate vSMB packet data.

Kernel-mode drivers in Windows Server 2008 SP2, R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows 10, and Windows Server 2016 allow a local authenticated attacker to execute a specially crafted application to obtain information or, in Windows 7 and later, cause denial of service.

CMS Made Simple (CMSMS) version 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions.

An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.

Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS.

Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.

Xen versions up to 4.8.x on 64-bit platforms mishandle page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS.

An issue was discovered on OnePlus devices such as the 3T related to the OTA updater that pushes the signed OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs, it unnecessarily increases the attack surface.