Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 8898 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-25738 2 Microsoft, Mozilla 4 Windows, Firefox, Firefox Esr and 1 more 2025-01-09 6.5 Medium
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
CVE-2024-5828 4 Hitachi, Linux, Microsoft and 1 more 4 Tuning Manager, Linux Kernel, Windows and 1 more 2025-01-09 8.6 High
Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.
CVE-2023-33693 2 Microsoft, Tsingsee 2 Windows, Easyplayerpro 2025-01-08 7.8 High
A buffer overflow in EasyPlayerPro-Win v3.2.19.0106 to v3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.
CVE-2023-6006 2 Microsoft, Papercut 3 Windows, Papercut Mf, Papercut Ng 2025-01-08 7.8 High
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
CVE-2024-25693 3 Esri, Linux, Microsoft 3 Portal For Arcgis, Linux Kernel, Windows 2025-01-08 9.9 Critical
There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. 
CVE-2023-41718 2 Ivanti, Microsoft 2 Secure Access Client, Windows 2025-01-07 7.8 High
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file.
CVE-2023-38543 2 Ivanti, Microsoft 2 Secure Access Client, Windows 2025-01-07 7.8 High
A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine.
CVE-2023-35080 2 Ivanti, Microsoft 2 Secure Access Client, Windows 2025-01-07 7.8 High
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information disclosure.
CVE-2023-44337 3 Adobe, Apple, Microsoft 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more 2025-01-07 7.8 High
Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-44367 3 Adobe, Apple, Microsoft 6 Acrobat, Acrobat Dc, Acrobat Reader and 3 more 2025-01-07 7.8 High
Adobe Acrobat Reader versions 23.006.20360 (and earlier) and 20.005.30524 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2022-31693 2 Microsoft, Vmware 2 Windows, Tools 2025-01-07 5.5 Medium
VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS.
CVE-2024-45073 5 Hp, Ibm, Linux and 2 more 7 Hp-ux, Aix, Websphere Application Server and 4 more 2025-01-07 4.8 Medium
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2019-16283 2 Hp, Microsoft 2 Softpaq Installer, Windows 2025-01-06 7.8 High
A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution.
CVE-2024-12108 2 Microsoft, Progress 2 Windows, Whatsup Gold 2025-01-06 9.6 Critical
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.
CVE-2023-5528 4 Fedoraproject, Kubernetes, Microsoft and 1 more 4 Fedora, Kubernetes, Windows and 1 more 2025-01-03 7.2 High
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVE-2023-0837 3 Apple, Microsoft, Teamviewer 3 Macos, Windows, Remote 2025-01-02 6.6 Medium
An improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allows an unprivileged user to change basic local device settings even though the options were locked. This can result in unwanted changes to the configuration.
CVE-2023-28603 2 Microsoft, Zoom 2 Windows, Virtual Desktop Infrastructure 2025-01-02 7.7 High
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
CVE-2023-34120 2 Microsoft, Zoom 2 Windows, Virtual Desktop Infrastructure 2025-01-02 8.7 High
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.
CVE-2023-34121 2 Microsoft, Zoom 4 Windows, Rooms, Virtual Desktop Infrastructure and 1 more 2025-01-02 4.1 Medium
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
CVE-2024-11112 2 Google, Microsoft 2 Chrome, Windows 2025-01-02 7.5 High
Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)