Microsoft Security Center Center News

Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.