Microsoft Windows Installer Improper Privilege Management Vulnerability

Microsoft · Windows

Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.

Microsoft Publisher Protection Mechanism Failure Vulnerability

Microsoft · Publisher

Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft · Exchange Server

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft · Windows

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft · Windows

Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.

Microsoft Project Remote Code Execution Vulnerability

Microsoft · Project

Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.

Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability

Microsoft · Windows

Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.

Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft · Internet Explorer

Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.

Microsoft Windows Hyper-V Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Microsoft · Windows

Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Microsoft · Windows

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

Microsoft · Windows

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.

Microsoft DWM Core Library Privilege Escalation Vulnerability

Microsoft · DWM Core Library

Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.

Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

Microsoft · SmartScreen Prompt

Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Microsoft · Windows

Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.

Microsoft SharePoint Server Code Injection Vulnerability

Microsoft · SharePoint Server

Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft · Windows

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

Microsoft · Streaming Service

Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft · Exchange Server

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Microsoft · Windows

Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.