Microsoft : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2013-1336	20			2013-05-14	2013-05-15	5.0	None	Remote	Low	Not required	None	Partial	None
The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allows remote attackers to make undetected changes to signed XML documents via unspecified vectors that preserve signature validity, aka "XML Digital Signature Spoofing Vulnerability."
2	CVE-2013-1305	119		DoS Overflow	2013-05-14	2013-05-15	5.0	None	Remote	Low	Not required	None	None	Partial
HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header, aka "HTTP.sys Denial of Service Vulnerability."
3	CVE-2013-1299				2013-03-29	2013-04-02	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Windows Modern Mail allows remote attackers to spoof link targets via a crafted HTML e-mail message.
4	CVE-2013-1282	20		DoS	2013-04-09	2013-04-10	5.0	None	Remote	Low	Not required	None	None	Partial
The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD LDS), and Active Directory Services allows remote attackers to cause a denial of service (memory consumption and service outage) via a crafted query, aka "Memory Consumption Vulnerability."
5	CVE-2013-0095	200		+Info	2013-03-12	2013-05-03	5.0	None	Remote	Low	Not required	Partial	None	None
Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the installation of a WebKit browser on the victim's machine, aka "Unintended Content Loading Vulnerability."
6	CVE-2013-0086	119		Overflow +Info	2013-03-12	2013-05-03	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."
7	CVE-2013-0013	264		Bypass	2013-01-09	2013-02-25	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle encrypted packets, which allows man-in-the-middle attackers to conduct SSLv2 downgrade attacks against (1) SSLv3 sessions or (2) TLS sessions by intercepting handshakes and injecting content, aka "Microsoft SSL Version 3 and TLS Protocol Security Feature Bypass Vulnerability."
8	CVE-2012-6502	200		+Info	2013-01-22	2013-01-28	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a \\127.0.0.1\C$\ sequence.
9	CVE-2012-2551			DoS	2012-10-09	2013-03-01	5.0	None	Remote	Low	Not required	None	None	Partial
The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted session request, aka "Kerberos NULL Dereference Vulnerability."
10	CVE-2012-2549	20		Bypass	2012-12-11	2013-02-25	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attackers to bypass intended access restrictions via a revoked certificate, aka "Revoked Certificate Bypass Vulnerability."
11	CVE-2012-2532	200		+Info	2012-11-13	2013-03-05	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session, which allows remote attackers to obtain sensitive information by reading the replies to these commands, aka "FTP Command Injection Vulnerability."
12	CVE-2012-1896	200		+Info	2012-11-13	2013-03-05	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "Code Access Security Info Disclosure Vulnerability."
13	CVE-2012-1860	264		DoS +Info	2012-07-10	2012-08-13	5.5	None	Remote	Low	Single system	Partial	None	Partial
Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability."
14	CVE-2012-1850	20		DoS	2012-08-14	2013-01-29	5.0	None	Remote	Low	Not required	None	None	Partial
The Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle RAP responses, which allows remote attackers to cause a denial of service (service hang) via crafted RAP packets, aka "Remote Administration Protocol Denial of Service Vulnerability."
15	CVE-2012-1545	119		DoS Overflow Mem. Corr. Bypass	2012-03-09	2012-03-12	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
16	CVE-2012-0164			DoS	2012-05-08	2012-08-13	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to cause a denial of service (application hang) via crafted requests to a Windows Presentation Foundation (WPF) application, aka ".NET Framework Index Comparison Vulnerability."
17	CVE-2012-0147	16		+Info	2012-04-10	2013-03-06	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability."
18	CVE-2012-0146	20			2012-04-10	2012-12-05	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability."
19	CVE-2012-0006	399		DoS	2012-03-13	2013-03-06	5.0	None	Remote	Low	Not required	None	None	Partial
The DNS server in Microsoft Windows Server 2003 SP2 and Server 2008 SP2, R2, and R2 SP1 does not properly handle objects in memory during record lookup, which allows remote attackers to cause a denial of service (daemon restart) via a crafted query, aka "DNS Denial of Service Vulnerability."
20	CVE-2011-4689	264			2011-12-07	2012-03-06	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
21	CVE-2011-2012	20		DoS	2011-10-11	2012-01-26	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS outage) via unspecified network traffic, aka "Null Session Cookie Crash."
22	CVE-2011-2008	20		DoS	2011-10-11	2012-01-26	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Access of Unallocated Memory DoS Vulnerability."
23	CVE-2011-2007	20		DoS	2011-10-11	2012-01-26	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability."
24	CVE-2011-1970	119		DoS Overflow Mem. Corr.	2011-08-10	2011-10-04	5.0	None	Remote	Low	Not required	None	None	Partial
The DNS server in Microsoft Windows Server 2003 SP2 and Windows Server 2008 SP2, R2, and R2 SP1 does not properly initialize memory, which allows remote attackers to cause a denial of service (service outage) via a query for a nonexistent domain, aka "DNS Uninitialized Memory Corruption Vulnerability."
25	CVE-2011-1652	16			2011-04-06	2011-04-06	5.0	None	Remote	Low	Not required	None	Partial	None
DISPUTED The default configuration of Microsoft Windows 7 immediately prefers a new IPv6 and DHCPv6 service over a currently used IPv4 and DHCPv4 service upon receipt of an IPv6 Router Advertisement (RA), and does not provide an option to ignore an unexpected RA, which allows remote attackers to conduct man-in-the-middle attacks on communication with external IPv4 servers via vectors involving RAs, a DHCPv6 server, and NAT-PT on the local network, aka a "SLAAC Attack." NOTE: it can be argued that preferring IPv6 complies with RFC 3484, and that attempting to determine the legitimacy of an RA is currently outside the scope of recommended behavior of host operating systems.
26	CVE-2011-1271	264		Exec Code Bypass	2011-05-10	2011-08-12	5.1	None	Remote	High	Not required	Partial	Partial	Partial
The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."
27	CVE-2011-1244	264		+Info	2011-04-13	2011-07-18	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site, aka "Frame Tag Information Disclosure Vulnerability."
28	CVE-2011-0040	20		DoS	2011-02-08	2011-07-18	5.0	None	Remote	Low	Not required	None	None	Partial
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers name collisions, aka "Active Directory SPN Validation Vulnerability."
29	CVE-2010-5071	264		+Info	2011-12-07	2012-03-07	5.0	None	Remote	Low	Not required	Partial	None	None
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method.
30	CVE-2010-3332	310			2010-09-22	2011-10-03	5.0	None	Remote	Low	Not required	Partial	None	None
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption attempts, which allows remote attackers to decrypt and modify encrypted View State (aka __VIEWSTATE) form data, and possibly forge cookies or read application files, via a padding oracle attack, aka "ASP.NET Padding Oracle Vulnerability."
31	CVE-2010-2742			DoS	2010-12-16	2011-07-18	5.4	None	Remote	High	Not required	None	None	Complete
The Netlogon RPC Service in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, and R2, when the domain controller role is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted RPC packet, aka "Netlogon RPC Null dereference DOS Vulnerability."
32	CVE-2010-2732	20			2010-11-09	2011-07-18	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka "UAG Redirection Spoofing Vulnerability."
33	CVE-2010-1991	399		DoS	2010-05-20	2010-05-21	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.
34	CVE-2010-1127			DoS Exec Code	2010-03-26	2010-03-29	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement.
35	CVE-2010-0025	200		+Info	2010-04-14	2011-07-18	5.0	None	Remote	Low	Not required	Partial	None	None
The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, aka "SMTP Memory Allocation Vulnerability."
36	CVE-2010-0024	20		DoS	2010-04-14	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability."
37	CVE-2009-4073	200		+Info	2009-11-24	2011-07-18	5.0	None	Remote	Low	Not required	Partial	None	None
The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.
38	CVE-2009-3943			DoS	2009-11-16	2009-11-18	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (application hang) via a JavaScript loop that configures the home page by using the setHomePage method and a DHTML behavior property.
39	CVE-2009-3830	20			2009-10-30	2009-11-09	5.0	None	Remote	Low	Not required	Partial	None	None
The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx.
40	CVE-2009-3555	310			2009-11-09	2012-10-22	5.8	None	Remote	Medium	Not required	None	Partial	Partial
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
41	CVE-2009-3275	134		DoS	2009-09-21	2009-09-22	5.0	None	Remote	Low	Not required	None	None	Partial
Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many \ (backslash) characters followed by a " (double quote), related to a certain regular expression, aka a "ReDoS" vulnerability.
42	CVE-2009-3270	399		DoS	2009-09-18	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821.
43	CVE-2009-3267	399		DoS	2009-09-18	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element, a related issue to CVE-2009-1828.
44	CVE-2009-3019	94	1	DoS	2009-08-31	2009-11-04	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value attribute.
45	CVE-2009-2954	20		DoS	2009-08-24	2010-09-02	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.
46	CVE-2009-2764		1	DoS	2009-08-14	2009-08-15	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location.
47	CVE-2009-2576	399		DoS	2009-07-22	2009-08-07	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
48	CVE-2009-2196				2009-08-12	2009-08-18	5.0	None	Remote	Low	Not required	None	Partial	None
Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.
49	CVE-2009-2069	287			2009-06-15	2009-06-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
50	CVE-2009-2057	287			2009-06-15	2009-06-25	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

Total number of vulnerabilities : 622 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13