Vendor
Microsoft
14,257 known vulnerabilities.
Products
14,257 results · Feed
-
Medium 6.5
Microsoft PowerShell Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Critical 9.9
Entra ID Elevation of Privilege Vulnerability
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Windows DNS Server Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
Medium 5.9
Windows DNS Denial of Service Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network.
-
High 8.8
Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
-
High 7.0
Windows Image Acquisition Elevation of Privilege Vulnerability
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Microsoft Entra ID Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
-
High 8.5
Power Automate Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
-
High 8.5
Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
-
Critical 10.0
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.3
Copilot Studio Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure AI Language Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
-
High 8.5
Microsoft Fabric Elevation of Privilege Vulnerability
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
-
High 7.4
Microsoft Discovery Studio Information Disclosure Vulnerability
Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
-
High 8.6
Windows ML CLI: CORS misconfig enables localhost RCE
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authenticatio…
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 4.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Microsoft Edge (Chromium-based) Spoofing Vulnerability
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
Medium 4.4
Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.
-
Medium 5.4
Microsoft Edge for iOS Spoofing Vulnerability
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Se…
-
Critical 10.0
Azure SQL Database Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
-
High 7.7
Microsoft Copilot in Azure Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.
-
High 8.5
Azure Virtual Machines Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.
-
High 8.6
Microsoft Partner Center Information Disclosure Vulnerability
Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.
-
Critical 10.0
Azure Arc Elevation of Privilege Vulnerability
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Azure Logic Apps Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
-
High 8.5
Azure Data Manager for Energy Remote Code Execution Vulnerability
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
-
Critical 9.9
Azure SQL Database Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.