Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 10251 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-20337 4 Apple, Cisco, Linux and 1 more 4 Macos, Secure Client, Linux Kernel and 1 more 2025-07-22 8.2 High
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
CVE-2025-20259 2 Cisco, Microsoft 2 Thousandeyes Endpoint Agent, Windows 2025-07-22 5.3 Medium
Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrary files on an affected device. These vulnerabilities are due to improper access controls on files that are in the local file system. An attacker could exploit these vulnerabilities by using a symbolic link to perform an agent upgrade that redirects the delete operation of any protected file. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.
CVE-2025-27051 2 Microsoft, Qualcomm 21 Windows, Fastconnect 6900, Fastconnect 6900 Firmware and 18 more 2025-07-21 7.8 High
Memory corruption while processing command message in WLAN Host.
CVE-2025-3619 2 Google, Microsoft 2 Chrome, Windows 2025-07-15 8.8 High
Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2024-8196 2 Microsoft, Mintplexlabs 2 Windows, Anythingllm Desktop 2025-07-15 N/A
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
CVE-2025-43580 3 Adobe, Apple, Microsoft 3 Audition, Macos, Windows 2025-07-15 5.5 Medium
Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application denial-of-service. An attacker could leverage this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-27165 3 Adobe, Apple, Microsoft 3 Substance 3d Stager, Macos, Windows 2025-07-14 5.5 Medium
Substance3D - Stager versions 3.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-47109 3 Adobe, Apple, Microsoft 3 After Effects, Macos, Windows 2025-07-14 5.5 Medium
After Effects versions 25.2, 24.6.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-43587 3 Adobe, Apple, Microsoft 3 After Effects, Macos, Windows 2025-07-14 5.5 Medium
After Effects versions 25.2, 24.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-47135 3 Adobe, Apple, Microsoft 3 Dimension, Macos, Windows 2025-07-14 5.5 Medium
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-30312 3 Adobe, Apple, Microsoft 3 Dimension, Macos, Windows 2025-07-14 7.8 High
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-47120 2 Adobe, Microsoft 2 Framemaker, Windows 2025-07-14 5.5 Medium
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-49524 3 Adobe, Apple, Microsoft 3 Illustrator, Macos, Windows 2025-07-14 5.5 Medium
Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-47119 2 Adobe, Microsoft 2 Framemaker, Windows 2025-07-14 5.5 Medium
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-49525 3 Adobe, Apple, Microsoft 3 Illustrator, Macos, Windows 2025-07-14 5.5 Medium
Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-30313 3 Adobe, Apple, Microsoft 3 Illustrator, Macos, Windows 2025-07-14 5.5 Medium
Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-11364 2 Microsoft, Rockwellautomation 2 Windows, Arena 2025-07-11 7.3 High
Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVE-2024-52928 2 Microsoft, Thebrowser 2 Windows, Arc 2025-07-10 9.6 Critical
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.
CVE-2024-32488 2 Foxit, Microsoft 3 Pdf Editor, Pdf Reader, Windows 2025-07-09 7.8 High
In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there.
CVE-2024-30330 2 Foxit, Microsoft 3 Pdf Editor, Pdf Reader, Windows 2025-07-09 7.8 High
Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22636.