Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
