Microsoft Windows - 14518 CVEs (Page 72/121)

About “Microsoft Windows”

A curated feed of “Microsoft Windows”-related CVEs appears below. We currently track 14518 CVEs for this tag (all time). In the last 365 days, 1678 were published. Average CVSS is 7.3 (all time; 7.2 over 365d), and 66% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-416 - Use After Free, CWE-122 - Heap-based Buffer Overflow, CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition').

In our taxonomy this topic maps to a MODERATE impact class. Issues here typically affect operating system packages or kernels. Plan reboots or service restarts and coordinate rollouts across fleets. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2018-03-27

High

CVE-2018-9047

In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact b…

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-9046

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-9045

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

2018-03-26

Critical

CVE-2018-5472

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their l…

CVSS: 9.8 CWE: CWE-264 View on NVD

2018-03-25

High

CVE-2018-7719

Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.

CVSS: 7.5 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

High

CVE-2018-8997

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8996

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8995

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8994

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8993

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8992

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8991

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8990

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8989

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-8988

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

2018-03-22

High

CVE-2018-5731

An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is…

CVSS: 7.0 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-0552

Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in…

CVSS: 7.8 CWE: CWE-426 - Untrusted Search Path View on NVD

High

CVE-2018-1448

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instan…

CVSS: 7.7 CWE: N/A View on NVD

Medium

CVE-2018-1428

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM…

CVSS: 6.2 CWE: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm View on NVD

Medium

CVE-2018-1427

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 13…

CVSS: 6.2 CWE: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer View on NVD

High

CVE-2018-1426

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate S…

CVSS: 7.4 CWE: CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) View on NVD

High

CVE-2017-1677

IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially…

CVSS: 7.4 CWE: CWE-502 - Deserialization of Untrusted Data View on NVD

Medium

CVE-2017-1571

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…

CVSS: 5.1 CWE: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm View on NVD

High

CVE-2018-8904

CVSS: 7.8 CWE: CWE-20 - Improper Input Validation View on NVD

2018-03-20

High

CVE-2014-1215

Multiple buffer overflows in Core FTP Server before 1.2 build 508 allow local users to gain privileges via vectors related to reading data from config.dat and Windows Registry.

CVSS: 7.8 CWE: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer View on NVD

Medium

CVE-2018-3626

Edger8r tool in the Intel SGX SDK before version 2.1.2 (Linux) and 1.9.6 (Windows) may generate code that is susceptible to a side channel potentially allowing a local user to access unauthorized inf…

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-5438

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exist…

CVSS: 6.3 CWE: CWE-613 - Insufficient Session Expiration View on NVD

Medium

CVE-2018-4843

A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All…

CVSS: 6.5 CWE: CWE-20 - Improper Input Validation View on NVD

2018-03-19

High

CVE-2018-1197

In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this acces…

CVSS: 8.5 CWE: CWE-732 - Incorrect Permission Assignment for Critical Resource View on NVD

2018-03-14

High

CVE-2018-0983

Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects a…

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0977

The Windows kernel mode driver in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how objects a…

CVSS: 7.0 CWE: N/A View on NVD

Low

CVE-2018-0942

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Serv…

CVSS: 2.6 CWE: N/A View on NVD

Medium

CVE-2018-0939

ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnera…

CVSS: 4.3 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0937

ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnera…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0936

ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability".…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0935

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2…

CVSS: 7.5 CWE: CWE-416 - Use After Free View on NVD

High

CVE-2018-0934

ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra S…

CVSS: 7.5 CWE: CWE-755 - Improper Handling of Exceptional Conditions View on NVD

High

CVE-2018-0933

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2018-0932

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511…

CVSS: 4.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2018-0931

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0930

ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corrupti…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2018-0929

CVSS: 4.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0927

CVSS: 4.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0926

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016…

CVSS: 5.5 CWE: CWE-665 - Improper Initialization View on NVD

Medium

CVE-2018-0904

The Windows kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Win…

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2018-0902

The Cryptography Next Generation (CNG) kernel-mode driver (cng.sys) in Windows 10 Gold, 1511, 1607, 1703, and 1709. Windows Server 2016 and Windows Server, version 1709 allows a security feature bypa…

CVSS: 7.8 CWE: N/A View on NVD

Medium

CVE-2018-0901

CVSS: 4.7 CWE: CWE-401 - Missing Release of Memory after Effective Lifetime View on NVD

Medium

CVE-2018-0900

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0899

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0898

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0897

CVSS: 4.7 CWE: CWE-665 - Improper Initialization View on NVD

Medium

CVE-2018-0896

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0895

CVSS: 4.7 CWE: CWE-401 - Missing Release of Memory after Effective Lifetime View on NVD

Medium

CVE-2018-0894

CVSS: 4.7 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2018-0893

Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memor…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2018-0891

ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in W…

CVSS: 4.3 CWE: CWE-401 - Missing Release of Memory after Effective Lifetime View on NVD

High

CVE-2018-0889

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2018-0888

The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and…

CVSS: 5.6 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-0886

The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511,…

CVSS: 7.0 CWE: CWE-287 - Improper Authentication View on NVD

Medium

CVE-2018-0885

The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 a…

CVSS: 5.8 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-0884

Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass vulnerability due to how objects are…

CVSS: 7.8 CWE: N/A View on NVD

High

CVE-2018-0883

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016 and Windows Se…

CVSS: 7.5 CWE: N/A View on NVD

High

CVE-2018-0882

The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how the virtual registry is managed,…

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0881

The Microsoft Video Control in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 201…

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0880

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0879

Microsoft Edge in Windows 10 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability".

CVSS: 7.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Low

CVE-2018-0878

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Serv…

CVSS: 3.1 CWE: CWE-611 - Improper Restriction of XML External Entity Reference View on NVD

High

CVE-2018-0877

The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how file pa…

CVSS: 7.8 CWE: N/A View on NVD

High

CVE-2018-0876

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0874

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in mem…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0873

ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, a…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0872

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0868

Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016…

CVSS: 7.0 CWE: CWE-20 - Improper Input Validation View on NVD

High

CVE-2018-0817

The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and…

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0816

CVSS: 7.0 CWE: N/A View on NVD

High

CVE-2018-0815

The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privilege vulnerability due to the way objects are handled in memo…

CVSS: 7.0 CWE: N/A View on NVD

Medium

CVE-2018-0814

CVSS: 5.5 CWE: CWE-665 - Improper Initialization View on NVD

Medium

CVE-2018-0813

CVSS: 5.5 CWE: CWE-665 - Improper Initialization View on NVD

Medium

CVE-2018-0811

CVSS: 5.5 CWE: CWE-665 - Improper Initialization View on NVD

2018-03-12

High

CVE-2018-6321

Unquoted Windows search path vulnerability in the panda_url_filtering service in Panda Global Protection 17.0.1 allows local users to gain privileges via a malicious artefact.

CVSS: 7.8 CWE: CWE-428 - Unquoted Search Path or Element View on NVD

High

CVE-2018-6016

Unquoted Windows search path vulnerability in the srvInventoryWebServer service in 10-Strike Network Monitor 5.4 allows local users to gain privileges via a malicious artefact.

CVSS: 7.8 CWE: CWE-428 - Unquoted Search Path or Element View on NVD

Critical

CVE-2016-9953

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive informat…

CVSS: 9.8 CWE: CWE-125 - Out-of-bounds Read View on NVD

High

CVE-2016-9952

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-…

CVSS: 8.1 CWE: CWE-295 - Improper Certificate Validation View on NVD

2018-03-07

Medium

CVE-2018-1000117

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, li…

CVSS: 6.7 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

2018-03-04

High

CVE-2018-7449

SEGGER FTP Server for Windows before 3.22a allows remote attackers to cause a denial of service (daemon crash) via an invalid LIST, STOR, or RETR command.

CVSS: 7.5 CWE: CWE-20 - Improper Input Validation View on NVD

2018-03-02

High

CVE-2015-7966

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executa…

CVSS: 7.8 CWE: CWE-264 View on NVD

High

CVE-2015-7965

CVSS: 7.8 CWE: CWE-264 View on NVD

High

CVE-2015-7596

SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modi…

CVSS: 7.8 CWE: CWE-264 View on NVD

2018-02-28

High

CVE-2018-6947

An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain elevatio…

CVSS: 7.8 CWE: CWE-665 - Improper Initialization View on NVD

2018-02-27

Medium

CVE-2018-0489

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to…

CVSS: 6.5 CWE: CWE-347 - Improper Verification of Cryptographic Signature View on NVD

2018-02-26

Medium

CVE-2018-7250

An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel po…

CVSS: 5.5 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

High

CVE-2018-7249

An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls…

CVSS: 7.0 CWE: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') View on NVD

High

CVE-2018-7484

An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNServic…

CVSS: 7.8 CWE: CWE-426 - Untrusted Search Path View on NVD

2018-02-21

Low

CVE-2018-7289

An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will…

CVSS: 3.3 CWE: CWE-172 - Encoding Error View on NVD

2018-02-20

Medium

CVE-2018-6356

Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Ov…

CVSS: 6.5 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

2018-02-19

High

CVE-2018-6592

Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cleanup of memory used for negotiation key storage.

CVSS: 7.8 CWE: CWE-404 - Improper Resource Shutdown or Release View on NVD

2018-02-18

Medium

CVE-2018-7212

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

CVSS: 5.3 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

2018-02-15

Medium

CVE-2017-12553

A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12552

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12551

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12550

A local security misconfiguration vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12549

A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: CWE-287 - Improper Authentication View on NVD

Medium

CVE-2017-12548

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12547

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: N/A View on NVD

Medium

CVE-2017-12546

A local buffer overflow vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.6 CWE: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer View on NVD

High

CVE-2017-12545

A remote denial of service vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Medium

CVE-2017-12544

A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

CVSS: 5.4 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

High

CVE-2018-7052

An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur.

CVSS: 7.5 CWE: CWE-476 - NULL Pointer Dereference View on NVD

Critical

CVE-2018-5440

A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based CODESYS web servers running stand-alone Version 2.3, or as pa…

CVSS: 9.8 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

High

CVE-2018-0866

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0861

Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corrup…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0860

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, ak…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0859

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0857

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0856

Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vu…

CVSS: 7.5 CWE: CWE-787 - Out-of-bounds Write View on NVD

Medium

CVE-2018-0855

The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded…

CVSS: 4.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD

Medium

CVE-2018-0847

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2…

CVSS: 4.3 CWE: CWE-787 - Out-of-bounds Write View on NVD

High

CVE-2018-0846

The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709,…

CVSS: 7.8 CWE: N/A View on NVD

High

CVE-2018-0844

CVSS: 7.8 CWE: N/A View on NVD

Medium

CVE-2018-0843

The Windows kernel in Windows 10 version 1709 and Windows Server, version 1709 allows an information disclosure vulnerability due to how objects in memory are handled, aka "Windows Kernel Information…

CVSS: 4.7 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD