Vendor
Microsoft
14,257 known vulnerabilities.
Products
508 results · Clear filters · Feed
-
Critical 9.8
Windows CCFFilter Driver Remote Code Execution Vulnerability
Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Error Reporting Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Error Reporting Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft PowerShell Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows iSCSI Remote Code Execution Vulnerability
Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows iSCSI Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows iSCSI Remote Code Execution Vulnerability
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Rich Text Edit Control Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows libarchive Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Visual Studio Code Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft Bookings Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the int…
-
Critical 9.1
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input …
-
Critical 10.0
Microsoft Fabric Elevation of Privilege Vulnerability
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Billing Elevation of Privilege Vulnerability
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure AI Foundry Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Logic Apps Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
-
Critical 9.0
Microsoft Dataverse Elevation of Privilege Vulnerability
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Arc Elevation of Privilege Vulnerability
Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Container Registry Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.3
Azure Arc Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Skype for Business Remote Code Execution Vulnerability
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.
-
Critical 9.0
Spring Cloud Azure Elevation of Privilege Vulnerability
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows iSCSI Security Feature Bypass Vulnerability
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
-
Critical 9.8
Microsoft Failover Cluster Remote Code Execution Vulnerability
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Imaging Component Remote Code Execution Vulnerability
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
-
Critical 9.8
Windows Hyper-V Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Shell Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.