CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server due to improper input neutralization during web page generation. Allows an unauthorized attacker to perform spoofing over a network.

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.

Vulnerability in Visual Studio Code involving inclusion of functionality from an untrusted control sphere, allowing an unauthorized attacker to elevate privileges locally.

Heap-based buffer overflow in Remote Desktop Client. An unauthenticated attacker can execute code over a network.

Integer overflow or wraparound vulnerability in Windows Kerberos. Allows an authorized attacker to execute code over an adjacent network.

In md-fileserver prior to version 1.10.3, an XSS vulnerability exists in the Markdown rendering logic. User-supplied Markdown content with embedded raw HTML, including <script> tags, is processed and injected into the page without sanitization, allowing arbitrary JavaScript execution in the affected domain.

FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.

Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.

A protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.

Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.

Untrusted pointer dereference vulnerability in Microsoft Office. An unauthorized attacker can exploit this flaw to execute code locally.

Cross-Site Scripting (XSS) vulnerability in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.

Untrusted pointer dereference vulnerability in Microsoft Office Word. An unauthorized attacker can exploit this flaw to execute code locally.

A type confusion vulnerability in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.

Windows RDP contains an out-of-bounds read vulnerability that allows an unauthorized attacker to disclose information over a network.