CVE Vulnerability Advisory Database

[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems

[Impact] An unauthenticated remote attacker can execute arbitrary code with system/kernel privileges over the network by sending specially crafted IKE packets

[Mitigation] Apply the official Microsoft security updates immediately, and restrict external access to IKE/IPsec ports (UDP 500/4500) as a temporary workaround

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Microsoft Windows 10 (versions 1903, 1909) and Windows Server (versions 1903, 1909) running the SMBv3 (Server Message Block 3.1.1) protocol

[Impact] Unauthenticated remote attackers can execute arbitrary code with kernel privileges (RCE) or escalate local privileges (LPE) by sending specially crafted packets, enabling wormable self-propagation across networks

[Mitigation] Apply official Microsoft security patches immediately, or implement workarounds such as disabling SMBv3 compression and blocking inbound TCP port 445

[Affected Scope] Legacy Windows operating systems including Windows XP, Windows 7, Windows Server 2003, Windows Server 2008, and 2008 R2

[Impact] An unauthenticated remote attacker can execute arbitrary code with kernel-level privileges or trigger a system crash (DoS) by sending specially crafted RDP requests, enabling wormable self-propagation across networks

[Mitigation] Immediately apply the official Microsoft security patches, or disable RDP services and enable Network Level Authentication (NLA) if patching is not feasible

[Affected Scope] Broad range of Microsoft Windows operating systems including Windows XP, Vista, 7, 8, 8.1, 10, and Windows Server 2003, 2008, 2012, 2016.

[Impact] An unauthenticated remote attacker can exploit this vulnerability via SMB to execute arbitrary code with SYSTEM privileges, leading to full system compromise.

[Mitigation] Immediately apply the official Microsoft security patches, or disable the Windows Search service and block SMB port (TCP 445) as a temporary workaround.

[Affected Scope] Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 R2 running IIS (Internet Information Services).

[Impact] Remote unauthenticated attackers can execute arbitrary code with SYSTEM privileges or trigger a Blue Screen of Death (BSOD), leading to complete system compromise or infrastructure denial of service.

[Mitigation] Apply the official Microsoft MS15-034 security patch immediately, or disable IIS Kernel Caching as a temporary workaround.

[Affected Scope] Microsoft Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7 Pre-Beta

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges and gain full control of the target system via crafted RPC requests

[Mitigation] Apply the official Microsoft security patch (MS08-067) immediately and restrict external access to SMB ports (TCP 139/445)