Microsoft

8,209 results · Clear filters · Feed

• High 7.5
  CVE-2017-11905

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memor…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Dec 12, 2017
• High 7.5
  CVE-2017-11893 Public exploit EPSS 68%

  ChakraCore vulnerable to remote code execution

  ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memor…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Dec 12, 2017
• High 7.5
  CVE-2017-11883

  Denial of service in ASP.NET Core

  .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".

  Microsoft ASP.NET Microsoft.AspNetCore.Server.HttpSys Microsoft.AspNetCore.Server.WebListener NuGet
  Nov 15, 2017
• High 7.8
  CVE-2017-11882 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…

  Microsoft Microsoft Office
  Nov 15, 2017

  KEV Nov 3, 2021
• High 7.5
  CVE-2017-11870 Public exploit EPSS 60%

  Chakra Core vulnerable to privilege escalation when writing to JavaScript null scope objects

  ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vu…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Nov 15, 2017
• High 7.5
  CVE-2017-11770

  Improper Certificate Validation

  .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles p…

  Microsoft .NET Core Microsoft.NETCore.App System.Security.Cryptography.X509Certificates NuGet
  Nov 15, 2017
• High 7.5
  CVE-2017-11862

  Chakra Core vulnerable to privilege escalation due to type confusion

  ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerabi…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Nov 15, 2017
• High 8.8
  CVE-2017-11879

  Open redirect in ASP.NET Core

  ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".

  Microsoft ASP.NET Core Microsoft.AspNetCore.All Microsoft.AspNetCore.Mvc.Core NuGet
  Nov 15, 2017
• High 7.5
  CVE-2017-11871

  Chakra Core vulnerable to privilege escalation due to reading an invalid pointer

  ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vu…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Nov 15, 2017
• High 7.5
  CVE-2017-8700 EPSS 10%

  Cross-origin Resource Sharing bypass in ASP.NET Core

  ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".

  Microsoft ASP.NET Core Microsoft.AspNetCore.Mvc.Core Microsoft.AspNetCore.Mvc.Cors NuGet
  Nov 15, 2017
• High 7.5
  CVE-2017-11797

  ChakraCore RCE Vulnerability

  ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-…

  Microsoft ChakraCore Microsoft.ChakraCore NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11792

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allow an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This …

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11807

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11796

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11805

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11821

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.8
  CVE-2017-11774 Exploited Public exploit EPSS 60%

  Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary comman…

  Microsoft Microsoft Outlook
  Oct 13, 2017

  KEV Nov 3, 2021
• High 7.5
  CVE-2017-11801

  ChakraCore RCE Vulnerability

  ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-…

  Microsoft ChakraCore Microsoft.ChakraCore NuGet
  Oct 13, 2017
• High 7.5
  CVE-2017-11806

  ChakraCore RCE Vulnerability

  ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This…

  Microsoft ChakraCore, Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  Oct 13, 2017
• High 7.8
  CVE-2017-11826 Exploited Public exploit EPSS 82%

  Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Ser…

  Microsoft Microsoft Office
  Oct 13, 2017

  KEV Mar 3, 2022
• High 7.8
  CVE-2017-8759 Exploited Public exploit EPSS 89%

  Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely v…

  Microsoft Microsoft .NET Framework
  Sep 13, 2017

  KEV Nov 3, 2021
• High 7.5
  CVE-2017-8585

  Improper Input Validation in Microsoft.NETCore.App

  Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.

  Microsoft Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 Microsoft.NETCore.App NuGet
  Jul 11, 2017
• High 7.8
  CVE-2017-8570 Exploited Public exploit EPSS 90%

  Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mi…

  Microsoft Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, and Microsoft Office 2016.
  Jul 11, 2017

  KEV Feb 25, 2022
• High 8.8
  CVE-2017-8464 Exploited Public exploit EPSS 90%

  Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20…

  Microsoft Windows Shell Windows
  Jun 15, 2017

  KEV Feb 10, 2022
• High 7.8
  CVE-2017-8540 Exploited Public exploit EPSS 72%

  The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serv…

  Microsoft Malware Protection Engine
  May 26, 2017

  KEV Mar 3, 2022
• High 7.5
  CVE-2017-0235 EPSS 11%

  ChakraCore RCE Vulnerability

  A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-022…

  Microsoft Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  May 12, 2017
• High 7.5
  CVE-2017-0224 EPSS 11%

  ChakraCore RCE Vulnerability

  A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230…

  Microsoft Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  May 12, 2017
• High 7.8
  CVE-2017-0261 Exploited Public exploit EPSS 78%

  Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

  Microsoft Microsoft Office
  May 12, 2017

  KEV Mar 3, 2022
• High 7.3
  CVE-2017-0213 Exploited · Ransomware Public exploit EPSS 84%

  Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Se…

  Microsoft Windows COM Windows
  May 12, 2017

  KEV Mar 28, 2022
• High 7.5
  CVE-2017-0247 EPSS 17%

  ASP.NET Core fails to properly validate web requests

  A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package…

  Microsoft ASP.NET Core Microsoft.AspNetCore.Mvc.Core System.Text.Encodings.Web NuGet
  May 12, 2017
• High 7.8
  CVE-2017-0262 Exploited EPSS 81%

  Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the softwa…

  Microsoft Microsoft Office
  May 12, 2017

  KEV Feb 10, 2022
• High 7.8
  CVE-2017-0263 Exploited Public exploit EPSS 10%

  The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…

  Microsoft Microsoft Windows Windows
  May 12, 2017

  KEV Feb 10, 2022
• High 8.8
  CVE-2017-0222 Exploited EPSS 30%

  A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Interne…

  Microsoft Internet Explorer
  May 12, 2017

  KEV Feb 25, 2022
• High 7.5
  CVE-2017-0234 EPSS 38%

  ChakraCore RCE Vulnerability

  A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-022…

  Microsoft Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  May 12, 2017
• High 7.3
  CVE-2017-0249

  High severity vulnerability that affects Microsoft.AspNetCore.Mvc

  An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

  Microsoft ASP.NET Core Microsoft.AspNetCore.Mvc.Core Microsoft.AspNetCore.Mvc.Cors NuGet
  May 12, 2017
• High 7.5
  CVE-2017-0236 EPSS 32%

  ChakraCore RCE Vulnerability

  A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-022…

  Microsoft Microsoft Edge Microsoft.ChakraCore Browsers NuGet
  May 12, 2017
• High 8.8
  CVE-2017-0210 Exploited EPSS 22%

  An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, …

  Microsoft Internet Explorer
  Apr 12, 2017

  KEV May 24, 2022
• High 7.8
  CVE-2017-0199 Exploited · Ransomware Public exploit EPSS 99%

  Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windo…

  Microsoft Office/WordPad
  Apr 12, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-0001 Exploited

  The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; …

  Microsoft Windows GDI+ Windows
  Mar 17, 2017

  KEV Mar 3, 2022
• High 7.8
  CVE-2017-0101 Exploited · Ransomware Public exploit EPSS 57%

  The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows …

  Microsoft Windows Windows
  Mar 17, 2017

  KEV Mar 15, 2022