Microsoft : Security Vulnerabilities, CVEs, CVSS score >= 8
Xbox Gaming Services Elevation of Privilege Vulnerability
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-03-21
Updated
2024-03-21
Microsoft Exchange Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Max CVSS
8.2
EPSS Score
0.09%
Published
2024-02-23
Updated
2024-02-26
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Visual Studio Code Elevation of Privilege Vulnerability
Max CVSS
8.8
EPSS Score
0.05%
Published
2024-03-12
Updated
2024-03-12
Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.05%
Published
2024-03-12
Updated
2024-03-12
Microsoft ODBC Driver Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft ODBC Driver Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
Max CVSS
9.8
EPSS Score
0.04%
Published
2024-02-12
Updated
2024-02-12
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
Max CVSS
9.8
EPSS Score
0.67%
Published
2024-01-09
Updated
2024-01-12
IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.
Max CVSS
8.8
EPSS Score
0.07%
Published
2024-01-10
Updated
2024-01-19
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.
Max CVSS
9.8
EPSS Score
0.13%
Published
2024-01-10
Updated
2024-01-19
Microsoft ODBC Driver Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-03-12
Updated
2024-03-12
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft ODBC Driver Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-03-12
Updated
2024-03-12
Windows OLE Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-12
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.09%
Published
2024-02-13
Updated
2024-02-13
Microsoft Outlook Remote Code Execution Vulnerability
Max CVSS
9.8
EPSS Score
0.66%
Published
2024-02-13
Updated
2024-02-23
CVE-2024-21412
Known exploited
Internet Shortcut Files Security Feature Bypass Vulnerability
Max CVSS
8.1
EPSS Score
0.36%
Published
2024-02-13
Updated
2024-03-07
CISA KEV Added
2024-02-13
Skype for Consumer Remote Code Execution Vulnerability
Max CVSS
8.8
EPSS Score
0.12%
Published
2024-03-12
Updated
2024-03-12
CVE-2024-21410
Known exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
Max CVSS
9.8
EPSS Score
1.86%
Published
2024-02-13
Updated
2024-02-26
CISA KEV Added
2024-02-15
Windows Hyper-V Remote Code Execution Vulnerability
Max CVSS
8.1
EPSS Score
0.09%
Published
2024-03-12
Updated
2024-03-21
3505 vulnerabilities found
1
2
3
4
5
6 ......
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141