60.383 CVE seguite
809 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Vulnerabilità Microsoft
17.848 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2017-11843 | HIGH 7.5 | microsoft chakracore ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Wi | 8,5% | — |
| CVE-2024-49040 | HIGH 7.5 | microsoft exchange_server Microsoft Exchange Server Spoofing Vulnerability | 8,5% | — |
| CVE-2017-8669 | HIGH 7.5 | microsoft edge Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the curr | 8,5% | — |
| CVE-2019-0971 | MED 6.5 | microsoft azure_devops_server An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Informat | 8,5% | — |
| CVE-2018-8160 | MED 6.5 | microsoft office An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Word, Microsoft Office. | 8,5% | — |
| CVE-1999-0007 | MED 5.0 | c2net stonghold_web_server Information from SSL-encrypted sessions via PKCS #1. | 8,5% | — |
| CVE-2025-53766 | CRIT 9.8 | microsoft 365_copilot Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | 8,5% | — |
| CVE-1999-0721 | HIGH 7.8 | microsoft windows_2000 Denial of service in Windows NT Local Security Authority (LSA) through a malformed LSA request. | 8,5% | — |
| CVE-1999-0726 | HIGH 7.8 | microsoft windows_2000 An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header. | 8,5% | — |
| CVE-2014-9165 | HIGH 10.0 | adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8454 and CVE-2014-8455. | 8,5% | — |
| CVE-2014-8455 | HIGH 10.0 | adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8454 and CVE-2014-9165. | 8,5% | — |
| CVE-2014-8454 | HIGH 10.0 | adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8455 and CVE-2014-9165. | 8,5% | — |
| CVE-2016-4115 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2016-4114 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2016-4113 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2016-4112 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2016-4111 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2016-4109 | HIGH 7.5 | adobe flash_player Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in | 8,4% | — |
| CVE-2017-8736 | MED 4.3 | microsoft edge Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to obtain | 8,4% | — |
| CVE-2001-0045 | HIGH 10.0 | microsoft windows_nt The default permissions for the RAS Administration key in Windows NT 4.0 allows local users to execute arbitrary commands by changing the value to point to a malicious DLL, aka one of the "Registry Permissions" vulnerabilities. | 8,4% | — |
| CVE-2018-8493 | HIGH 7.5 | microsoft windows_10_1507 An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows | 8,4% | — |
| CVE-2011-1249 | HIGH 7.2 | microsoft windows_2003_server The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which | 8,4% | — |
| CVE-2000-0788 | HIGH 10.0 | microsoft access The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands. | 8,4% | — |
| CVE-2008-5823 | MED 4.3 | microsoft money An ActiveX control in prtstb06.dll in Microsoft Money 2006, when used with WScript in Windows Script Host (WSH) on Windows Vista, allows remote attackers to cause a denial of service (access violation and application crash) via a zero value for the Startup pro | 8,4% | — |
| CVE-2011-1897 | MED 4.3 | microsoft forefront_unified_access_gateway Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability | 8,4% | — |