56.561 CVE tracked
773 Exploited now
181 Used by ransomware
Last sync
Microsoft vulnerabilities
15.454 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2011-1270 | HIGH 9.3 | microsoft powerpoint Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "Presentation Buffer Overrun RCE Vulnerability." | 16.3% | — |
| CVE-2016-3214 | HIGH 8.8 | microsoft edge The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE | 16.3% | — |
| CVE-2015-2530 | HIGH 9.3 | microsoft windows_10 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted | 16.3% | — |
| CVE-2012-2552 | MED 4.3 | microsoft sql_server Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP1, and 2012 allows remote attackers to inject arbitrary web script or HTML via an | 16.3% | — |
| CVE-2016-0139 | HIGH 7.8 | microsoft excel Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | 16.3% | — |
| CVE-2016-0055 | HIGH 7.8 | microsoft office Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | 16.3% | — |
| CVE-2016-7242 | HIGH 7.5 | microsoft edge The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabilit | 16.3% | — |
| CVE-1999-0233 | HIGH 10.0 | microsoft internet_information_services IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files. | 16.3% | — |
| CVE-2005-3595 | HIGH 10.0 | microsoft windows_xp By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to gain control of the computer. | 16.3% | — |
| CVE-2015-1686 | MED 4.3 | microsoft internet_explorer The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript A | 16.3% | — |
| CVE-2015-1684 | MED 4.3 | microsoft internet_explorer VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass." | 16.3% | — |
| CVE-2018-0903 | HIGH 7.8 | microsoft access Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Access Remote Code Execution Vulnerability" | 16.3% | — |
| CVE-2024-21407 | HIGH 8.1 | microsoft windows_10_1507 Windows Hyper-V Remote Code Execution Vulnerability | 16.3% | — |
| CVE-2006-0028 | MED 5.1 | microsoft excel Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory | 16.2% | — |
| CVE-2018-8375 | HIGH 7.8 | microsoft excel A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Excel Viewer, Microsoft Office, Microsoft E | 16.2% | — |
| CVE-2019-0546 | HIGH 7.8 | microsoft visual_studio_2017 A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio. | 16.2% | — |
| CVE-1999-0444 | MED 5.0 | microsoft windows_95 Remote attackers can perform a denial of service in Windows machines using malicious ARP packets, forcing a message box display for each packet or filling up log files. | 16.2% | — |
| CVE-1999-0357 | MED 5.0 | microsoft windows_98 Windows 98 and other operating systems allows remote attackers to cause a denial of service via crafted "oshare" packets, possibly involving invalid fragmentation offsets. | 16.2% | — |
| CVE-2016-3366 | MED 6.5 | microsoft outlook Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail a | 16.2% | — |
| CVE-2000-0266 | LOW 2.6 | microsoft internet_explorer Internet Explorer 5.01 allows remote attackers to bypass the cross frame security policy via a malicious applet that interacts with the Java JSObject to modify the DOM properties to set the IFRAME to an arbitrary Javascript URL. | 16.2% | — |
| CVE-2015-0070 | MED 4.3 | microsoft internet_explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability." | 16.2% | — |
| CVE-2004-0474 | MED 5.1 | microsoft windows_xp Help Center (HelpCtr.exe) may allow remote attackers to read or execute arbitrary files via an "http://" or "file://" argument to the topic parameter in an hcp:// URL. NOTE: since the initial report of this problem, several researchers have been unable to rep | 16.2% | — |
| CVE-2019-0790 | HIGH 8.8 | microsoft windows_10 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795. | 16.2% | — |
| CVE-2018-8636 | HIGH 7.8 | microsoft excel A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel | 16.2% | — |
| CVE-2018-8628 | HIGH 7.8 | microsoft office A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Micro | 16.2% | — |