Filtered by vendor Microsoft Subscriptions
Total 22253 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-58730 1 Microsoft 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more 2025-10-16 7 High
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVE-2025-58738 1 Microsoft 12 Windows 10 1507, Windows 10 1809, Windows 10 21h2 and 9 more 2025-10-16 7 High
Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVE-2025-58737 1 Microsoft 6 Windows Server 2012, Windows Server 2016, Windows Server 2019 and 3 more 2025-10-16 7 High
Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.
CVE-2025-58322 2 Microsoft, Navercorp 2 Windows, Mybox 2025-10-16 7.8 High
NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks.
CVE-2025-61787 2 Deno, Microsoft 2 Deno, Windows 2025-10-16 8.1 High
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
CVE-2025-53951 2 Fortinet, Microsoft 3 Fortidlp, Fortidlp Agent, Windows 2025-10-16 4.9 Medium
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to LocalService via sending a crafted request to a local listening port.
CVE-2025-53950 3 Apple, Fortinet, Microsoft 4 Macos, Fortidlp, Fortidlp Agent and 1 more 2025-10-16 5.1 Medium
An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
CVE-2025-46752 2 Fortinet, Microsoft 3 Fortidlp, Fortidlp Agent, Windows 2025-10-16 4.2 Medium
A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure via re-using the enrollment code.
CVE-2025-34196 2 Microsoft, Vasion 4 Windows, Print Application, Virtual Appliance Application and 1 more 2025-10-16 9.8 Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic Certificate Authority (CA) and a hardcoded password in product configuration files. The Windows client ships the CA certificate and its associated private key (and other sensitive settings such as a configured password) directly in shipped configuration files (for example clientsettings.dat and defaults.ini). An attacker who obtains these files can impersonate the CA, sign arbitrary certificates trusted by the Windows client, intercept or decrypt TLS-protected communications, and otherwise perform man-in-the-middle or impersonation attacks against the product's network communications. This vulnerability has been identified by the vendor as: V-2022-001 — Configuration File Contains CA & Private Key.
CVE-2025-55315 2 Microsoft, Redhat 3 Asp.net Core, Visual Studio 2022, Enterprise Linux 2025-10-16 9.9 Critical
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVE-2025-33096 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 6.5 Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
CVE-2025-2140 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 5.7 Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
CVE-2025-2139 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 3.5 Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
CVE-2025-2138 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 3.5 Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
CVE-2025-59286 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-10-16 6.5 Medium
Copilot Spoofing Vulnerability
CVE-2025-55321 1 Microsoft 1 Azure Monitor 2025-10-16 8.7 High
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an authorized attacker to perform spoofing over a network.
CVE-2025-59272 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-10-16 6.5 Medium
Copilot Spoofing Vulnerability
CVE-2025-59252 1 Microsoft 2 365, 365 Copilot 2025-10-16 6.5 Medium
M365 Copilot Spoofing Vulnerability
CVE-2025-59247 1 Microsoft 2 Azure, Azure Playfab 2025-10-16 8.8 High
Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-59230 1 Microsoft 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more 2025-10-16 7.8 High
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.