58.560 CVE tracked
797 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.473 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2008-4258 | HIGH 8.5 | microsoft internet_explorer Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validat | 17.8% | — |
| CVE-2006-2380 | MED 4.3 | microsoft windows_2000 Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability." | 17.8% | — |
| CVE-2017-0062 | MED 4.7 | microsoft windows_10 The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive | 17.8% | — |
| CVE-2005-2224 | MED 5.0 | microsoft asp.net aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method. | 17.8% | — |
| CVE-2020-0995 | HIGH 7.8 | microsoft windows_10 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2 | 17.8% | — |
| CVE-2013-3917 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013 | 17.8% | — |
| CVE-2013-3916 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013 | 17.8% | — |
| CVE-2016-7283 | HIGH 8.8 | microsoft internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | 17.8% | — |
| CVE-2016-3367 | HIGH 8.8 | microsoft silverlight StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations, which allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Silverlight Memory Corr | 17.8% | — |
| CVE-1999-0815 | MED 5.0 | microsoft windows_nt Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries. | 17.8% | — |
| CVE-2020-0605 | HIGH 8.8 | microsoft .net_core A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework | 17.8% | — |
| CVE-2000-0544 | MED 5.0 | microsoft windows_2000 Windows NT and Windows 2000 hosts allow a remote attacker to cause a denial of service via malformed DCE/RPC SMBwriteX requests that contain an invalid data length. | 17.8% | — |
| CVE-2008-3957 | HIGH 9.3 | microsoft windows_image_acquisition_logger The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the firs | 17.8% | — |
| CVE-2003-1105 | LOW 2.6 | microsoft ie Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook Express crash) via HTML with certain input tags that are not properly rendered. | 17.7% | — |
| CVE-2002-0153 | HIGH 7.5 | microsoft ie Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, aka the "Local Applescript Invocation" vulnerability. | 17.7% | — |
| CVE-1999-1127 | HIGH 7.5 | microsoft windows_nt Windows NT 4.0 does not properly shut down invalid named pipe RPC connections, which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data, aka the "Named Pipes Over RPC" vulnerability. | 17.7% | — |
| CVE-2007-0675 | HIGH 7.6 | microsoft windows_vista A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activiti | 17.7% | — |
| CVE-2018-0859 | HIGH 7.5 | microsoft chakracore Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CV | 17.7% | — |
| CVE-2016-3289 | HIGH 7.5 | microsoft edge Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3322. | 17.7% | — |
| CVE-2023-35636 | MED 6.5 | microsoft 365_apps Microsoft Outlook Information Disclosure Vulnerability | 17.7% | — |
| CVE-1999-0877 | MED 4.3 | microsoft internet_explorer Internet Explorer 5 allows remote attackers to read files via an ExecCommand method called on an IFRAME. | 17.7% | — |
| CVE-2001-1489 | MED 5.0 | microsoft ie Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (CPU consumption and memory leak) via a web page with a large number of images. | 17.7% | — |
| CVE-2002-1745 | HIGH 7.5 | microsoft internet_information_services Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files. | 17.7% | — |
| CVE-2017-8632 | HIGH 7.8 | microsoft excel A remote code execution vulnerability exists in Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Web Apps 2013, Microsoft Excel for Mac 2011, Microsoft Exce | 17.7% | — |
| CVE-2015-1698 | HIGH 9.3 | microsoft windows_7 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journ | 17.6% | — |