Filtered by vendor Microsoft Subscriptions

Search

Switch to Advanced Search (Beta)
Total 22434 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-59288 2 Github, Microsoft 3 Github, Azure Playwright, Playwright 2025-10-27 5.3 Medium
Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent network.
CVE-2025-55334 1 Microsoft 6 Windows, Windows 11, Windows 11 22h2 and 3 more 2025-10-27 6.2 Medium
Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-55248 4 Apple, Linux, Microsoft and 1 more 22 Macos, Linux Kernel, .net and 19 more 2025-10-27 4.8 Medium
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVE-2025-50152 1 Microsoft 18 Windows, Windows 10, Windows 10 1507 and 15 more 2025-10-27 7.8 High
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2025-11955 2 Microsoft, Thegreenbow 6 Windows, Ipsec Vpn Client, Thegreenbow Vpn Client and 3 more 2025-10-27 N/A
Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
CVE-2025-12055 2 Microsoft, Mpdv Mikrolab 4 Windows, Fedra 2, Hydra X and 1 more 2025-10-27 7.5 High
HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
CVE-2025-55754 2 Apache, Microsoft 2 Tomcat, Windows 2025-10-27 5.3 Medium
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
CVE-2025-9164 2 Docker, Microsoft 2 Desktop, Windows 2025-10-27 N/A
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
CVE-2025-59275 1 Microsoft 19 Windows, Windows 10, Windows 10 1507 and 16 more 2025-10-27 7.8 High
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59277 1 Microsoft 19 Windows, Windows 10, Windows 10 1507 and 16 more 2025-10-27 7.8 High
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59278 1 Microsoft 19 Windows, Windows 10, Windows 10 1507 and 16 more 2025-10-27 7.8 High
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVE-2025-59282 1 Microsoft 21 Iis, Windows, Windows 10 and 18 more 2025-10-27 7 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVE-2025-59285 1 Microsoft 3 Azure, Azure Monitor, Azure Monitor Agent 2025-10-27 7 High
Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVE-2023-23376 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-10-27 7.8 High
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-23397 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2025-10-27 9.8 Critical
Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2025-29824 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-10-27 7.8 High
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2023-24880 1 Microsoft 10 Windows 10 1607, Windows 10 1809, Windows 10 20h2 and 7 more 2025-10-27 4.4 Medium
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2025-24054 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-10-27 6.5 Medium
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-24983 1 Microsoft 5 Windows 10 1507, Windows 10 1607, Windows Server 2008 and 2 more 2025-10-27 7 High
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CVE-2025-24984 1 Microsoft 14 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 11 more 2025-10-27 4.6 Medium
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.