Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 8.8 (HIGH)
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network. CVSSv3.1 8.8 (HIGH)
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network. CVSSv3.1 9.1 (CRITICAL)
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. CVSSv3.1 9.8 (CRITICAL)
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. CVSSv3.1 9.8 (CRITICAL)
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. CVSSv3.1 8.8 (HIGH)
Improper access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. CVSSv3.1 8.8 (HIGH)
Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.1 (HIGH)
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. CVSSv3.1 8.8 (HIGH)
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. CVSSv3.1 9.3 (CRITICAL)
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 9.3 (CRITICAL)
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSSv3.1 8.0 (HIGH)
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. CVSSv3.1 8.4 (HIGH)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. CVSSv3.1 8.3 (HIGH)
Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. CVSSv3.1 8.8 (HIGH)