CVE-2014-6363 | ByteOS Network

Vulnerability Details :

CVE-2014-6363

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-11 Dec, 2014 | 00:00

Updated At-06 Aug, 2024 | 12:10

vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:11 Dec, 2014 | 00:00

Updated At:06 Aug, 2024 | 12:10

▼CVE Numbering Authority (CNA)

vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080	vendor-advisory x_refsource_MS
https://www.exploit-db.com/exploits/40721/	exploit x_refsource_EXPLOIT-DB
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075	third-party-advisory x_refsource_IDEFENSE
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084	vendor-advisory x_refsource_MS

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: https://www.exploit-db.com/exploits/40721/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075

Resource:

third-party-advisory

x_refsource_IDEFENSE

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084

Resource:

vendor-advisory

x_refsource_MS

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080	vendor-advisory x_refsource_MS x_transferred
https://www.exploit-db.com/exploits/40721/	exploit x_refsource_EXPLOIT-DB x_transferred
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075	third-party-advisory x_refsource_IDEFENSE x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084	vendor-advisory x_refsource_MS x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/40721/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075

Resource:

third-party-advisory

x_refsource_IDEFENSE

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084

Resource:

vendor-advisory

x_refsource_MS

x_transferred

▼National Vulnerability Database (NVD)

Source:secure@microsoft.com

Published At:11 Dec, 2014 | 00:59

Updated At:12 Apr, 2025 | 10:46

vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-399	Primary	nvd@nist.gov

CWE ID: CWE-399

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080	secure@microsoft.com	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084	secure@microsoft.com	N/A
https://www.exploit-db.com/exploits/40721/	secure@microsoft.com	N/A
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075	secure@microsoft.com	Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080	af854a3a-2127-422b-91ae-364da2661108	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.exploit-db.com/exploits/40721/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://www.exploit-db.com/exploits/40721/

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://www.exploit-db.com/exploits/40721/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Similar CVEs

3425Records found

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-59.74% / 98.21%

||

7 Day CHG-0.57%

Published-09 Jan, 2007 | 23:00

Updated-07 Aug, 2024 | 12:03

Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file.

Vendor-n/a Microsoft Corporation

Product-outlook office n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-34.30% / 96.89%

||

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-office n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-25.39% / 96.09%

||

7 Day CHG~0.00%

Published-10 Oct, 2006 | 22:00

Updated-07 Aug, 2024 | 18:30

Unspecified vulnerability in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac allows remote user-assisted attackers to execute arbitrary code via a crafted string that triggers memory corruption.

Vendor-n/a Microsoft Corporation

Product-office n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-65.10% / 98.43%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-22 Oct, 2025 | 00:15

Known KEV||Action Due Date - 2022-06-15||Apply updates per vendor instructions.

atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Open Type Font Remote Code Execution Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_10_1507 windows_server_2012 windows_server_2008 windows_10_1607 windows_vista windows_rt_8.1 windows_8.1 windows_server_2016 windows_10_1511 n/a Windows

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-30.02% / 96.54%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-word_for_mac office_compatibility_pack office word excel_for_mac n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.31% / 87.00%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, and CVE-2016-6922.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 82.28%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.37%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 82.28%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-11.16% / 93.33%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os flash_player_for_linux enterprise_linux_server windows_server_2016 linux_kernel enterprise_linux_desktop windows_rt_8.1 enterprise_linux_workstation windows windows_server_2012 windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-704

Incorrect Type Conversion or Cast

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.87% / 86.01%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-6981.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.08% / 91.97%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os enterprise_linux_server windows_server_2016 linux_kernel enterprise_linux_desktop windows_rt_8.1 windows_8.1 enterprise_linux_workstation windows windows_server_2012 flash_player_for_linux mac_os_x windows_10 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-31.56% / 96.68%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Video Control Remote Code Execution Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_rt_8.1 windows_vista windows_8.1 windows_10 n/a

CWE ID-CWE-284

Improper Access Control

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-17.77% / 94.98%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Media Foundation Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_rt_8.1 windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-38.40% / 97.14%

||

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Uniscribe Remote Code Execution Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_7 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 windows_10 n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-23.26% / 95.83%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-22 Oct, 2025 | 00:15

Known KEV||Action Due Date - 2022-04-15||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Microsoft Corporation Apple Inc.Google LLC Adobe Inc.

Product-mac_os_x flash_player windows linux_kernel windows_10 flash_player_desktop_runtime windows_8.1 chrome_os Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier Flash Player

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-23.02% / 95.79%

||

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-internet_explorer n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 82.28%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-17.77% / 94.98%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Animation Manager in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Animation Manager Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_7 windows_server_2008 windows_rt_8.1 windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.62% / 81.53%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6932.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-40.71% / 97.28%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow remote attackers to execute arbitrary code via a crafted image file, aka "Windows Remote Code Execution Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_7 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-284

Improper Access Control

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-44.05% / 97.45%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-excel sharepoint_server excel_for_mac n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.37%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-71.20% / 98.68%

||

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-22 Oct, 2025 | 00:15

Known KEV||Action Due Date - 2022-03-24||Apply updates per vendor instructions.

Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-office word word_viewer office_compatibility_pack n/a Office

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.08% / 91.97%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os enterprise_linux_server windows_server_2016 linux_kernel enterprise_linux_desktop windows_rt_8.1 windows_8.1 enterprise_linux_workstation windows windows_server_2012 flash_player_for_linux mac_os_x windows_10 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.37%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6989.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.09% / 89.61%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Clipboard class related to data handling functionality. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.96% / 83.25%

||

7 Day CHG~0.00%

Published-31 Mar, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Integer overflow in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 windows_xp quicktime windows_vista n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-31.60% / 96.68%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-excel excel_for_mac office_compatibility_pack n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-48.35% / 97.66%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-word_for_mac office_web_apps office_compatibility_pack sharepoint_server office word excel_for_mac n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 82.28%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-1.75% / 82.28%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6931.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-30.02% / 96.54%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, and Office 2016 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-office n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-11.16% / 93.33%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os flash_player_for_linux enterprise_linux_server windows_server_2016 linux_kernel enterprise_linux_desktop windows_rt_8.1 enterprise_linux_workstation windows windows_server_2012 windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-704

Incorrect Type Conversion or Cast

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-3.92% / 88.07%

||

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:09

Updated-05 May, 2025 | 17:16

Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Microsoft Corporation Adobe Inc.

Product-bridge windows Adobe Bridge

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.94% / 90.46%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-28.98% / 96.46%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-excel excel_for_mac office_compatibility_pack n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-4.51% / 88.90%

||

7 Day CHG~0.00%

Published-17 Jul, 2020 | 00:01

Updated-04 Aug, 2024 | 10:34

Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Microsoft Corporation Adobe Inc.

Product-windows download_manager Adobe Download Manager

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.08% / 91.97%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Red Hat, Inc.Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os enterprise_linux_server windows_server_2016 linux_kernel enterprise_linux_desktop windows_rt_8.1 windows_8.1 enterprise_linux_workstation windows windows_server_2012 flash_player_for_linux mac_os_x windows_10 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.37%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6990.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-34.18% / 96.88%

||

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-publisher n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-3.92% / 88.07%

||

7 Day CHG~0.00%

Published-26 Jun, 2020 | 20:09

Updated-05 May, 2025 | 17:16

Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Microsoft Corporation Adobe Inc.

Product-bridge windows Adobe Bridge

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.37%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-18.90% / 95.17%

||

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Microsoft Excel for Mac 2011 and Excel 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-excel_for_mac n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.79% / 92.35%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-4.90% / 89.40%

||

7 Day CHG~0.00%

Published-25 Jun, 2020 | 21:15

Updated-04 Aug, 2024 | 10:34

Adobe Premiere Rush versions 1.5.12 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Microsoft Corporation Adobe Inc.

Product-windows premiere_rush Adobe Premiere Rush

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-3.00% / 86.30%

||

7 Day CHG~0.00%

Published-25 Jun, 2020 | 21:06

Updated-04 Aug, 2024 | 10:34

Adobe After Effects versions 17.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Microsoft Corporation Adobe Inc.

Product-windows after_effects Adobe After Effects

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-8.8||HIGH

EPSS-21.17% / 95.54%

||

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

The Graphics component in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Remote Code Execution Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_10 n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-5.38% / 89.91%

||

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to gain privileges via a crafted application, aka "Windows Common Log File System Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0026, CVE-2016-3332, CVE-2016-3333, CVE-2016-3334, CVE-2016-3335, CVE-2016-3338, CVE-2016-3340, CVE-2016-3342, and CVE-2016-3343.

Vendor-n/a Microsoft Corporation

Product-windows_server_2016 windows_7 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-5.09% / 89.61%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the PSDK class related to ad policy functionality method. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

CWE ID-CWE-787

Out-of-bounds Write