CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Windows Win32k Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2016-3309, MS16-098)
[Affected Scope] Multiple legacy Windows operating systems including Windows Vista SP2, 7 SP1, 8.1, 10, and Windows Server 2008, 2012
[Impact] Local attackers can execute arbitrary code in kernel mode via a crafted application, gaining complete control of the affected system
[Mitigation] Apply the official Microsoft security patch (MS16-098) immediately, and migrate end-of-life operating systems to supported versions
Microsoft Windows Media Center .MCL File Parsing Remote Code Execution Vulnerability (CVE-2016-0185, MS16-059)
[Affected Scope] Windows Media Center on Windows Vista SP2, Windows 7 SP1, and Windows 8.1
[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the logged-in user via a crafted .mcl file
[Mitigation] Apply the official MS16-059 security update, restrict execution of untrusted .mcl files, or disassociate the .mcl file extension
Microsoft Windows Win32k Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2016-0167, MS16-039)
[Affected Scope] Windows Vista SP2, 7 SP1, 8.1, 10, Windows Server 2008, 2012 R2, and other legacy Windows OS versions
[Impact] Local attackers can execute arbitrary code in kernel mode (SYSTEM privileges) via a crafted application, leading to full system compromise
[Mitigation] Apply the official Microsoft MS16-039 security patch immediately and restrict local execution privileges on unpatched systems
Microsoft Windows Win32k Kernel-Mode Driver Elevation of Privilege Vulnerability (CVE-2016-0165, MS16-039)
[Affected Scope] Windows Vista SP2, 7 SP1, 8.1, 10, and Windows Server 2008/2012 legacy operating systems
[Impact] Local attackers can execute a specially crafted application to gain SYSTEM-level privileges and fully compromise the host
[Mitigation] Apply the official Microsoft security update (MS16-039) immediately and restrict local execution permissions on unpatched systems
Windows CSRSS Process Token Mismanagement Local Privilege Escalation Vulnerability (CVE-2016-0151, MS16-048)
[Affected Scope] Microsoft Windows 8.1, Windows Server 2012 and R2, Windows RT 8.1, and Windows 10 (Gold and 1511).
[Impact] A local attacker can execute a crafted application to exploit improper token management in CSRSS, gaining elevated SYSTEM privileges and executing arbitrary code.
[Mitigation] Apply the official Microsoft security updates (MS16-048) immediately and restrict local execution privileges on unpatched systems.
Microsoft Windows Secondary Logon Local Privilege Escalation Vulnerability (CVE-2016-0099, MS16-032)
[Affected Scope] Windows Vista SP2, 7 SP1, 8.1, 10, and Windows Server 2008, 2012 R2 with Secondary Logon service enabled
[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges via a crafted application, leading to complete system compromise
[Mitigation] Apply the official MS16-032 security patch immediately, or disable the Secondary Logon (seclogon) service as a temporary workaround
Microsoft Windows Kernel Elevation of Privilege Vulnerability (CVE-2016-0040, MS16-014) Technical Advisory
[Affected Scope] Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1
[Impact] Local attackers can execute arbitrary code in kernel mode and gain elevated SYSTEM privileges via a crafted application
[Mitigation] Apply the official Microsoft MS16-014 security patch immediately, or isolate legacy systems and enforce strict application whitelisting
Microsoft Windows Win32k Kernel-Mode Driver Memory Corruption Privilege Escalation (CVE-2015-2546, MS15-097)
[Affected Scope] Legacy Windows operating systems including Windows Vista SP2, 7 SP1, 8, 8.1, 10, and Windows Server 2008/2012
[Impact] Local attackers can execute a crafted application to gain elevated SYSTEM privileges and fully compromise the host
[Mitigation] Apply the official Microsoft security update (MS15-097) immediately or upgrade to a supported OS version
Microsoft Windows Mount Manager Elevation of Privilege Vulnerability (CVE-2015-1769, MS15-085)
[Affected Scope] Windows Vista, 7, 8, 8.1, 10, and Windows Server 2008, 2012 legacy environments
[Impact] A physically proximate attacker can execute arbitrary code with SYSTEM privileges by connecting a crafted USB device, leading to full system compromise
[Mitigation] Apply the MS15-085 security update immediately and restrict unauthorized USB storage devices via Group Policy
Microsoft Windows Adobe Type Manager Library (atmfd.dll) Buffer Underflow Remote Code Execution Vulnerability (CVE-2015-2426)
[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, RT, and Windows Server 2008/2012
[Impact] Remote attackers can execute arbitrary code with kernel-level privileges by tricking users into rendering a specially crafted OpenType font
[Mitigation] Apply the official Microsoft MS15-078 security patch immediately, or disable the Adobe Type Manager Font Driver (atmfd.dll) as a temporary workaround
Windows Adobe Type Manager Font Driver (ATMFD.DLL) Memory Corruption Local Privilege Escalation (CVE-2015-2387)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems.
[Impact] Local attackers can execute arbitrary code in kernel mode via a crafted application, gaining complete control of the affected system.
[Mitigation] Apply the official Microsoft security patch (MS15-077) immediately, or disable the ATMFD.DLL driver via registry modification.
Microsoft Windows Win32k Kernel-Mode Driver Local Privilege Escalation Vulnerability (CVE-2015-2360, MS15-061)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems
[Impact] Local attackers can execute a crafted application to gain elevated SYSTEM privileges or cause a denial of service (memory corruption)
[Mitigation] Immediately apply the Microsoft official security patch (MS15-061) and restrict local execution privileges on unpatched assets
Microsoft Windows HTTP.sys Remote Code Execution Vulnerability (CVE-2015-1635, MS15-034) Technical Analysis and Mitigation Guide
[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).
[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.
[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.
Microsoft Windows TS WebProxy Directory Traversal Privilege Escalation and IE Sandbox Escape (CVE-2015-0016, MS15-004)
[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, Windows Server 2008 R2 SP1, 2012 R2 utilizing the TS WebProxy (TSWbPrxy) component
[Impact] Remote attackers can bypass the Internet Explorer Protected Mode sandbox (Low Integrity) and execute arbitrary code with Medium Integrity privileges via a crafted executable path
[Mitigation] Apply the official Microsoft MS15-004 security update immediately and restrict unauthorized ActiveX control execution
Microsoft Windows Kerberos KDC Signature Verification Bypass and Domain Privilege Escalation (CVE-2014-6324)
[Affected Scope] Active Directory Domain Controllers running Windows Server 2003, 2008, 2012, and associated Windows client operating systems
[Impact] A remote authenticated domain user can forge Kerberos ticket signatures (PAC) to escalate privileges to Domain Administrator, leading to a complete domain compromise
[Mitigation] Immediately apply the MS14-068 security update and perform a double reset of the krbtgt account password to invalidate existing forged tickets
Microsoft Windows OLE Automation Array Remote Code Execution Vulnerability (CVE-2014-6332) Technical Analysis and Mitigation Guide
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT environments
[Impact] Remote attackers can execute arbitrary code with user privileges and fully compromise the target system via a crafted website
[Mitigation] Immediately apply the MS14-064 security patch, restrict Internet Explorer usage, and disable VBScript execution on legacy systems
Microsoft Windows and Office IME (Japanese) Elevation of Privilege and Sandbox Escape (CVE-2014-4077)
[Affected Scope] Windows Server 2003/2008, Windows Vista, Windows 7, and Office 2007 environments with the Japanese Input Method Editor (IME) component IMJPDCT.EXE installed
[Impact] Remote attackers can bypass sandbox protection mechanisms via crafted PDF documents, escalating privileges to execute arbitrary code on the host system
[Mitigation] Apply the official Microsoft security update (MS14-078) or restrict execution permissions on the IMJPDCT.EXE binary
Microsoft Windows OLE Remote Code Execution Vulnerability (CVE-2014-6352) Analysis and Mitigation Guide
[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, Windows Server 2008/2012, and Windows RT systems
[Impact] Remote attackers can execute arbitrary code with the privileges of the current user via crafted OLE objects embedded in Office documents
[Mitigation] Apply the MS14-064 official security update immediately, or implement OLE execution blocking workarounds
Microsoft Windows win32k.sys TrueType Font Parsing Remote Code Execution Vulnerability (CVE-2014-4148, MS14-058)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems.
[Impact] Remote attackers can execute arbitrary code with kernel-mode privileges and gain full system control by enticing users to render specially crafted TrueType fonts.
[Mitigation] Apply the official Microsoft security update (MS14-058) immediately, or implement workarounds to block untrusted font rendering.
Microsoft Windows OLE Remote Code Execution Vulnerability (CVE-2014-4114, Sandworm APT)
[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, Windows Server 2008/2012, and RT systems
[Impact] Remote attackers can execute arbitrary code with user privileges by tricking a user into opening a crafted Office document containing a malicious OLE object
[Mitigation] Apply the MS14-060 official security patch and restrict execution of untrusted Office attachments