Filtered by vendor Microsoft Subscriptions
Filtered by product Windows Subscriptions
Total 9492 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-9950 2 Forescout, Microsoft 2 Secureconnector, Windows 2025-10-17 7.8 High
A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory.
CVE-2025-58322 2 Microsoft, Navercorp 2 Windows, Mybox 2025-10-16 7.8 High
NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks.
CVE-2025-61787 2 Deno, Microsoft 2 Deno, Windows 2025-10-16 8.1 High
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
CVE-2025-59938 2 Microsoft, Wazuh 2 Windows, Wazuh 2025-10-16 6.5 Medium
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions starting from 3.8.0 to before 4.11.0, wazuh-analysisd is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages. This issue has been patched in version 4.11.0.
CVE-2025-33096 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 6.5 Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
CVE-2025-2140 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 5.7 Medium
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
CVE-2025-2139 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 3.5 Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
CVE-2025-2138 3 Ibm, Linux, Microsoft 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more 2025-10-16 3.5 Low
IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
CVE-2025-36630 2 Microsoft, Tenable 2 Windows, Nessus 2025-10-15 8.4 High
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
CVE-2025-36225 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 4.3 Medium
IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
CVE-2023-37401 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 5.3 Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.
CVE-2025-36171 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 4.9 Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
CVE-2024-1443 2 Microsoft, Msi 2 Windows, Afterburner 2025-10-14 4.4 Medium
MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process.
CVE-2024-1460 2 Microsoft, Msi 2 Windows, Afterburner 2025-10-14 5.6 Medium
MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process.
CVE-2025-62186 2 Ankitects, Microsoft 2 Anki, Windows 2025-10-10 6.7 Medium
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
CVE-2025-62187 3 Ankitects, Linux, Microsoft 3 Anki, Linux, Windows 2025-10-10 2.9 Low
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).
CVE-2025-51060 2 Cpuid, Microsoft 3 Cpu-z, Cpuz.sys, Windows 2025-10-09 6.5 Medium
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled.
CVE-2025-49487 2 Microsoft, Trendmicro 3 Windows, Wfbs Saas, Worry-free Business Security Services 2025-10-09 6.8 Medium
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.
CVE-2024-9949 2 Forescout, Microsoft 2 Secureconnector, Windows 2025-10-09 6.1 Medium
Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application.
CVE-2025-54081 2 Lizardbyte, Microsoft 2 Sunshine, Windows 2025-10-08 6.7 Medium
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.