CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows HTTP Protocol Stack (HTTP.sys) Use-After-Free Remote Code Execution Vulnerability (CVE-2021-31166) Analysis and Mitigation Guide
[Affected Scope] HTTP.sys services running on Windows 10 versions 2004, 20H2 and Windows Server versions 2004, 20H2
[Impact] Unauthenticated remote attackers can execute arbitrary code in the kernel context or trigger an immediate Blue Screen of Death (BSOD) leading to Denial of Service (DoS) by sending specially crafted HTTP packets
[Mitigation] Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching
Microsoft Windows HTTP.sys Remote Code Execution Vulnerability (CVE-2015-1635, MS15-034) Technical Analysis and Mitigation Guide
[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).
[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.
[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.