Microsoft : Security Vulnerabilities Published In 2017 (Gain Privilege)
Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability".
| Max Base Score | 8.8 |
| Published | 2017-12-12 |
| Updated | 2019-10-03 |
| EPSS | 0.53% |
ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
| Max Base Score | 8.8 |
| Published | 2017-11-15 |
| Updated | 2018-02-01 |
| EPSS | 0.51% |
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability".
| Max Base Score | 8.8 |
| Published | 2017-11-15 |
| Updated | 2017-11-30 |
| EPSS | 0.35% |
Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to run arbitrary code in kernel mode, install programs, view, change or delete data, and create new accounts with full user rights due to improperly handing objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability".
| Max Base Score | 9.3 |
| Published | 2017-11-15 |
| Updated | 2019-10-03 |
| EPSS | 0.36% |
Microsoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update Delivery Optimization does not properly enforce file share permissions.
| Max Base Score | 5.5 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.07% |
The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability in the way it handles objects in memory, aka "Windows Graphics Component Elevation of Privilege Vulnerability".
| Max Base Score | 7.0 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.06% |
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability."
| Max Base Score | 9.3 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.59% |
Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability in the way it handles calls to Advanced Local Procedure Call (ALPC), aka "Windows Elevation of Privilege Vulnerability".
| Max Base Score | 7.0 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.06% |
The Microsoft Server Block Message (SMB) on Microsoft Windows 10 1607 and Windows Server 2016, allows an elevation of privilege vulnerability when an attacker sends specially crafted requests to the server, aka "Windows SMB Elevation of Privilege Vulnerability".
| Max Base Score | 7.8 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.09% |
Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
| Max Base Score | 6.1 |
| Published | 2017-09-13 |
| Updated | 2020-04-09 |
| EPSS | 0.29% |
An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability".
| Max Base Score | 5.4 |
| Published | 2017-09-13 |
| Updated | 2017-09-21 |
| EPSS | 0.21% |
The Microsoft Windows graphics component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8675.
| Max Base Score | 7.8 |
| Published | 2017-09-13 |
| Updated | 2019-10-03 |
| EPSS | 0.10% |
Windows Error Reporting (WER) in Microsoft Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows an attacker to gain greater access to sensitive information and system functionality, due to the way that WER handles and executes files, aka "Windows Elevation of Privilege Vulnerability".
| Max Base Score | 7.0 |
| Published | 2017-09-13 |
| Updated | 2019-10-03 |
| EPSS | 0.06% |
The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8689.
| Max Base Score | 7.0 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.06% |
The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8694.
| Max Base Score | 7.0 |
| Published | 2017-10-13 |
| Updated | 2019-10-03 |
| EPSS | 0.82% |
The Windows Kernel-Mode Drivers component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability".. This CVE ID is unique from CVE-2017-8720.
| Max Base Score | 7.0 |
| Published | 2017-09-13 |
| Updated | 2017-09-21 |
| EPSS | 0.07% |
The Xamarin.iOS update component on systems running macOS allows an attacker to run arbitrary code as root, aka "Xamarin.iOS Elevation Of Privilege Vulnerability."
| Max Base Score | 7.8 |
| Published | 2017-08-15 |
| Updated | 2021-09-08 |
| EPSS | 0.09% |
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.
| Max Base Score | 6.1 |
| Published | 2017-08-08 |
| Updated | 2017-08-14 |
| EPSS | 0.32% |
Windows Error Reporting (WER) in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability, aka "Windows Error Reporting Elevation of Privilege Vulnerability".
| Max Base Score | 8.5 |
| Published | 2017-08-08 |
| Updated | 2019-10-03 |
| EPSS | 0.54% |
Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability".
| Max Base Score | 5.4 |
| Published | 2017-09-13 |
| Updated | 2017-09-20 |
| EPSS | 0.19% |
CLFS in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows CLFS Elevation of Privilege Vulnerability".
| Max Base Score | 7.8 |
| Published | 2017-08-08 |
| Updated | 2019-10-03 |
| EPSS | 0.10% |
Windows Subsystem for Linux in Windows 10 1703 allows an elevation of privilege vulnerability when it fails to properly handle handles NT pipes, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability".
| Max Base Score | 7.8 |
| Published | 2017-08-08 |
| Updated | 2019-10-03 |
| EPSS | 0.11% |
Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."
| Max Base Score | 8.1 |
| Published | 2017-06-29 |
| Updated | 2019-10-03 |
| EPSS | 0.23% |
Microsoft Win32k in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability".
| Max Base Score | 7.0 |
| Published | 2017-08-08 |
| Updated | 2019-10-03 |
| EPSS | 0.06% |
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way that the Windows Common Log File System (CLFS) driver handles objects in memory, aka "Windows CLFS Elevation of Privilege Vulnerability".
| Max Base Score | 8.8 |
| Published | 2017-07-11 |
| Updated | 2019-10-03 |
| EPSS | 0.07% |