alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-0001 (published 2015-01-13)
The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability."
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2012
CVE-2015-0002 (published 2015-01-13)
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012
CVE-2015-0003 (published 2015-02-11)
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-476
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0004 (published 2015-01-13)
The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0005 (published 2015-03-11)
The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:M/Au:N/C:P/I:P/A:N)
Weakness: CWE-254
Affected vendors: microsoft
Affected products: windows_2003_server, windows_server_2008, windows_server_2012
CVE-2015-0006 (published 2015-01-13)
The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:C/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0008 (published 2015-02-11)
The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0009 (published 2015-02-11)
The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."
Severity: LOW (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0010 (published 2015-02-11)
The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-310
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0011 (published 2015-01-13)
mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:C/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012
CVE-2015-0012 (published 2015-02-11)
Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: virtual_machine_manager
CVE-2015-0014 (published 2015-01-13)
Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0015 (published 2015-01-13)
Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: windows_server_2003, windows_server_2008, windows_server_2012
CVE-2015-0016 (published 2015-01-13)
Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_vista
Added to CISA KEV catalog: 2022-05-25
KEV required action: Apply updates per vendor instructions.
CVE-2015-0017 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0018 (published 2015-02-11)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0037, CVE-2015-0040, and CVE-2015-0066.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0019 (published 2015-02-11)
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0020 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0021 (published 2015-02-11)
Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0022 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0023 (published 2015-02-11)
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0025.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0025 (published 2015-02-11)
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0023.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0026 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0027 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0035, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0028 (published 2015-02-11)
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0029 (published 2015-02-11)
Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0030 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0031 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0032 (published 2015-03-11)
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 8 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer, vbscript
CVE-2015-0035 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0036 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0041.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0037 (published 2015-02-11)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0040, and CVE-2015-0066.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0038 (published 2015-02-11)
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0042 and CVE-2015-0046.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0039 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0052, and CVE-2015-0068.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0040 (published 2015-02-11)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0066.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0041 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0036.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0042 (published 2015-02-11)
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0043 (published 2015-02-11)
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0044 (published 2015-02-11)
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0045 (published 2015-02-11)
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0053.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0046 (published 2015-02-11)
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0048 (published 2015-02-11)
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0049 (published 2015-02-11)
Microsoft Internet Explorer 8 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0050 (published 2015-02-11)
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0051 (published 2015-02-11)
Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0052 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0068.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0053 (published 2015-02-11)
Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0045.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0054 (published 2015-02-11)
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0055 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0056 (published 2015-03-11)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0057 (published 2015-02-11)
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0058 (published 2015-02-11)
Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-415
Affected vendors: microsoft
Affected products: windows_8.1, windows_rt_8.1, windows_server_2012
CVE-2015-0059 (published 2015-02-11)
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted TrueType font, aka "TrueType Font Parsing Remote Code Execution Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012
CVE-2015-0060 (published 2015-02-11)
The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-19
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0061 (published 2015-02-11)
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for TIFF images, which allows remote attackers to obtain sensitive information from process memory via a crafted image file, aka "TIFF Processing Information Disclosure Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0062 (published 2015-02-11)
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a process that uses the SeAssignPrimaryTokenPrivilege privilege, aka "Windows Create Process Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012
CVE-2015-0063 (published 2015-02-11)
Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: excel, excel_viewer, office, office_compatibility_pack
CVE-2015-0064 (published 2015-02-11)
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Office Remote Code Execution Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: office, office_compatibility_pack, sharepoint_server, web_applications, word, word_automation_services, word_viewer
CVE-2015-0065 (published 2015-02-11)
Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "OneTableDocumentStream Remote Code Execution Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: word
CVE-2015-0066 (published 2015-02-11)
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0040.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0067 (published 2015-02-11)
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0068 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0052.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0069 (published 2015-02-11)
Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0070 (published 2015-02-11)
Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0071 (published 2015-02-11)
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: microsoft
Affected products: internet_explorer, windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_vista
Added to CISA KEV catalog: 2022-05-25
KEV required action: Apply updates per vendor instructions.
CVE-2015-0072 (published 2015-02-07)
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: internet_explorer
CVE-2015-0073 (published 2015-03-11)
The Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict changes to virtual stores, which allows local users to gain privileges via a crafted application, aka "Registry Virtualization Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0074 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly allocate memory, which allows remote attackers to cause a denial of service via a crafted (1) web site or (2) file, aka "Adobe Font Driver Denial of Service Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-119
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0075 (published 2015-03-11)
The kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Impersonation Level Check Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_2003_server, windows_7, windows_server_2008, windows_vista
CVE-2015-0076 (published 2015-03-11)
The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0077 (published 2015-03-11)
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize function buffers, which allows local users to obtain sensitive information from kernel memory, and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0078 (published 2015-03-11)
win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: microsoft
Affected products: windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2012
CVE-2015-0079 (published 2015-03-11)
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to cause a denial of service (memory consumption and RDP outage) by establishing many RDP sessions that do not properly free allocated memory, aka "Remote Desktop Protocol (RDP) Denial of Service Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_server_2012
CVE-2015-0080 (published 2015-03-11)
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability."
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0081 (published 2015-03-11)
Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "WTS Remote Code Execution Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-19
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0084 (published 2015-03-11)
The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to bypass intended restrictions on launching executable files via a crafted task, aka "Task Scheduler Security Feature Bypass Vulnerability."
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2008, windows_server_2012
CVE-2015-0085 (published 2015-03-11)
Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Affected vendors: microsoft
Affected products: excel, excel_viewer, office, office_compatibility_pack, office_web_apps_server, powerpoint, sharepoint_foundation, sharepoint_server, sharepoint_services, web_applications, word
CVE-2015-0086 (published 2015-03-11)
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, and Web Apps Server 2013 Gold and SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-399
Affected vendors: microsoft
Affected products: office, office_compatibility_pack, office_web_apps_server, sharepoint_server, web_applications, word, word_viewer
CVE-2015-0087 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0088 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-94
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0089 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0090 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-94
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0091 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-94
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista
CVE-2015-0092 (published 2015-03-11)
Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-94
Affected vendors: microsoft
Affected products: windows_7, windows_8, windows_8.1, windows_rt, windows_rt_8.1, windows_server_2003, windows_server_2008, windows_server_2012, windows_vista