Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft SharePoint Server,
Microsoft SharePoint Server
... (+5)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft SharePoint Server,
Microsoft SharePoint Server
... (+5)
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Office,
Microsoft Office
... (+2)
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office Long Term Servicing Channel,
Microsoft Office Long Term Servicing Channel
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Excel,
Microsoft Office Online Server
... (+2)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Excel,
Microsoft Office Online Server
... (+2)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Excel,
Microsoft Office Online Server
... (+2)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft SharePoint Server,
Microsoft SharePoint Server
... (+3)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft SharePoint Server,
Microsoft SharePoint Server
... (+3)
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Configuration Manager 2503,
Microsoft Configuration Manager 2403,
Microsoft Configuration Manager 2409
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2016,
Microsoft Windows Server 2019
... (+15)
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 24h2,
Microsoft Windows Server 2025,
Microsoft Windows 11 25h2
Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2016,
Microsoft Windows Server 2019
... (+15)
Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2019,
Microsoft Windows Server 2022,
Microsoft Windows 10 1809
... (+8)
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 24h2,
Microsoft Windows Server 2025,
Microsoft Windows 11 25h2
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2019,
Microsoft Windows Server 2022,
Microsoft Windows 10 1809
... (+8)
Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2016,
Microsoft Windows Server 2019,
Microsoft Windows 10 1507
... (+11)
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2016,
Microsoft Windows Server 2019
... (+13)
Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2016,
Microsoft Windows Server 2019,
Microsoft Windows 10 1507
... (+11)
Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to deny service locally.
Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2016,
Microsoft Windows Server 2019,
Microsoft Windows 10 1507
... (+11)
Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2019,
Microsoft Windows Server 2022,
Microsoft Windows 10 1809
... (+8)
Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2008,
Microsoft Windows Server 2012,
Microsoft Windows Server 2016
... (+16)
Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.
Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose information locally.
Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.
Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally.
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2019,
Microsoft Windows 10 1507,
Microsoft Windows Server 2022
... (+9)
Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.
AFFECTED_PRODUCTS:
Microsoft Windows Server 2012,
Microsoft Windows Server 2016,
Microsoft Windows Server 2019
... (+3)