ByteOS

Product

Windows GDI+

Versions

Affected

Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1

Problem Types

Type	CWE ID	Description
text	N/A	Information Disclosure

Type: text

CWE ID: N/A

Description: Information Disclosure

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/42748/	exploit x_refsource_EXPLOIT-DB
http://www.securitytracker.com/id/1039338	vdb-entry x_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685	x_refsource_CONFIRM
http://www.securityfocus.com/bid/100724	vdb-entry x_refsource_BID

Hyperlink: https://www.exploit-db.com/exploits/42748/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: http://www.securitytracker.com/id/1039338

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/100724

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/42748/	exploit x_refsource_EXPLOIT-DB x_transferred
http://www.securitytracker.com/id/1039338	vdb-entry x_refsource_SECTRACK x_transferred
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/100724	vdb-entry x_refsource_BID x_transferred

Hyperlink: https://www.exploit-db.com/exploits/42748/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: http://www.securitytracker.com/id/1039338

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/100724

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:13 Sep, 2017 | 01:29

Updated At:13 May, 2026 | 00:24

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

>>windows_7>>-

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

>>windows_server_2008>>-

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

>>windows_server_2008>>r2

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/100724	secure@microsoft.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039338	secure@microsoft.com	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685	secure@microsoft.com	Patch Vendor Advisory
https://www.exploit-db.com/exploits/42748/	secure@microsoft.com	Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/100724	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039338	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://www.exploit-db.com/exploits/42748/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry

Hyperlink: http://www.securityfocus.com/bid/100724

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1039338

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://www.exploit-db.com/exploits/42748/

Source: secure@microsoft.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: http://www.securityfocus.com/bid/100724

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1039338

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8685

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://www.exploit-db.com/exploits/42748/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Third Party Advisory

VDB Entry

Similar CVEs

2068Records found

CVE-2015-0094

Matching Score-10

Matching Score-10

CVSS Score-2.1||LOW

EPSS-2.59% / 83.69%

7 Day CHG~0.00%

Published-11 Mar, 2015 | 10:00

Updated-06 May, 2026 | 22:30

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."

Product-windows_rt windows_7 windows_8.1 windows_server_2008 windows_vista windows_8 windows_rt_8.1 windows_server_2012 windows_server_2003 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-1434

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.7||MEDIUM

EPSS-0.34% / 26.10%

7 Day CHG~0.00%

Published-12 Sep, 2017 | 21:00

Updated-13 May, 2026 | 00:24

IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log to a local user.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-windows linux_kernel db2 db2_connect DB2 for Linux, UNIX and Windows

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-11835

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.38% / 82.15%

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-13 May, 2026 | 00:24

Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11832.

Product-windows_7 windows_server_2008 Microsoft Graphics

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-0188

Matching Score-10

Matching Score-10

CVSS Score-3.3||LOW

EPSS-2.98% / 85.83%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0189.

Product-windows_10 windows_8.1 windows_server_2016 windows_rt_8.1 windows_server_2012 Windows

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2017-0175

Matching Score-10

Matching Score-10

CVSS Score-4.7||MEDIUM

EPSS-7.05% / 93.51%

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-13 May, 2026 | 00:24

The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-0220, CVE-2017-0258, and CVE-2017-0259.

Product-windows_7 windows_server_2008 Microsoft Windows

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-8963

Matching Score-10

Assigner-IBM Corporation

Vendor-IBM Corporation Oracle Corporation Linux Kernel Organization, Inc HP Inc.Microsoft Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.31% / 22.88%

7 Day CHG~0.00%

Published-01 Feb, 2017 | 22:00

Updated-13 May, 2026 | 00:24

IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.

Product-hp-ux license_metric_tool solaris aix windows bigfix_inventory linux_kernel BigFix Inventory

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-7219

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-3.43% / 87.67%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-06 May, 2026 | 22:30

The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Windows Crypto Driver Information Disclosure Vulnerability."

Product-windows_10 windows_7 windows_8.1 windows_server_2008 windows_vista windows_server_2016 windows_rt_8.1 windows_server_2012 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-3800

Matching Score-10

Assigner-Dell

Product-single_sign-on edge_service_broker cloud_foundry_command_line_interface enterprise_service_broker businessworks_buildpack logme service_broker cloud_foundry_autoscaling_release conjur_service_broker db_enterprise seeker_iast_service_broker application_service cloud_foundry_log_cache_release mongodb google_cloud_platform_service_broker cloud_foundry_command_line_interface_release steelcentral_appinternals cloud_foundry_deployment_concourse_tasks application_monitoring postgresql cloud_foundry_networking_release on_demand_service_broker cloud_foundry_deployment pivotal_cloud_foundry_service_broker cloud_foundry_event_alerts pubsub\+rabbitmq dotnet_extension_buildpack wavefront_by_vmware_nozzle cloud_foundry_healthwatch nozzle azure_log_analytics_nozzle redis elasticsearch application_performance_monitoring cloud_foundry_routing_release cloud_foundry_smoke_test websphere_liberty_volume_service metric_registrar_release cloud_foundry_notifications application_analytics credhub_service_broker_for_pcf platform_montioring azure_service_broker mysql CF CLI CF CLI Release

Matching Score-10

Assigner-Dell

CVSS Score-6.3||MEDIUM

EPSS-2.09% / 79.62%

7 Day CHG~0.00%

Published-05 Aug, 2019 | 16:38

Updated-17 Sep, 2024 | 04:29

CF CLI writes the client id and secret to config file

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.

CWE ID-CWE-522

Insufficiently Protected Credentials

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-3344

Matching Score-10

Matching Score-10

CVSS Score-3.3||LOW

EPSS-3.81% / 88.92%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode Information Disclosure Vulnerability."

Product-windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1370

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.45% / 70.55%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 18:52

Updated-04 Aug, 2024 | 18:13

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.

Product-open_enclave_software_development_kit Open Enclave SDK

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1381

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.45% / 70.66%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 18:52

Updated-04 Aug, 2024 | 18:13

An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft Windows Information Disclosure Vulnerability'.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 Windows Windows Server Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows Server, version 1903 (Server Core installation)

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1474

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.54% / 72.37%

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:41

Updated-04 Aug, 2024 | 18:20

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1472.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1903 for x64-based Systems Windows Server Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows Server, version 1909 (Server Core installation)Windows 10 Version 1903 for 32-bit Systems Windows Server, version 1903 (Server Core installation)Windows 10 Version 1909 for 32-bit Systems

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1463

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.16% / 80.27%

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:40

Updated-04 Aug, 2024 | 18:20

An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400.

Product-office_365_proplus office Microsoft Office Office 365 ProPlus

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1469

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.63% / 73.80%

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:41

Updated-04 Aug, 2024 | 18:20

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1440

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.95% / 78.15%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 18:53

Updated-04 Aug, 2024 | 18:20

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1436.

Product-windows_server_2016 windows_server_2019 windows_10 Windows Windows Server Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows Server, version 1903 (Server Core installation)

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2015-0077

Matching Score-10

Matching Score-10

CVSS Score-2.1||LOW

EPSS-2.38% / 82.11%

7 Day CHG~0.00%

Published-11 Mar, 2015 | 10:00

Updated-06 May, 2026 | 22:30

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize function buffers, which allows local users to obtain sensitive information from kernel memory, and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."

Product-windows_rt windows_7 windows_8.1 windows_server_2008 windows_vista windows_8 windows_rt_8.1 windows_server_2012 windows_server_2003 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1283

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.62% / 73.54%

7 Day CHG~0.00%

Published-11 Sep, 2019 | 21:25

Updated-04 Aug, 2024 | 18:13

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'.

Product-windows_7 windows_server_2008 Windows Windows Server

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1293

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.06% / 79.35%

7 Day CHG~0.00%

Published-11 Sep, 2019 | 21:25

Updated-04 Aug, 2024 | 18:13

An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in memory, aka 'Windows SMB Client Driver Information Disclosure Vulnerability'.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Windows Server Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1903 for 32-bit Systems Windows Server, version 1903 (Server Core installation)

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1171

Matching Score-10

Matching Score-10

CVSS Score-5.6||MEDIUM

EPSS-1.37% / 69.06%

7 Day CHG~0.00%

Published-14 Aug, 2019 | 20:55

Updated-20 Feb, 2026 | 21:18

SymCrypt Information Disclosure Vulnerability

An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system. The update addresses the vulnerability through a software change to the OAEP decoding operations.

Product-windows_server_2016 windows_10 windows_server_2019 Windows 10 Version 1803 Windows Server 2019 (Server Core installation)Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1809 Windows 10 Version 1903 for 32-bit Systems Windows Server 2019 Windows 10 Version 1709 Windows Server, version 1803 (Server Core Installation)Windows Server, version 1903 (Server Core installation)Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1703

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1228

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.66% / 74.22%

7 Day CHG~0.00%

Published-14 Aug, 2019 | 20:55

Updated-20 Feb, 2026 | 21:18

Windows Kernel Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system. The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.

Product-windows_server_2008 windows_7 Windows Server 2008 R2 Service Pack 1 Windows Server 2008 Service Pack 2 (Server Core installation)Windows Server 2008 R2 Service Pack 1 (Server Core installation)Windows Server 2008 Service Pack 2 Windows Server 2008 R2 Systems Service Pack 1 Windows Server 2008 Service Pack 2 Windows 7 Windows 7 Service Pack 1

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-0013

Matching Score-10

Assigner-Palo Alto Networks, Inc.

Matching Score-10

Assigner-Palo Alto Networks, Inc.

CVSS Score-5||MEDIUM

EPSS-0.22% / 12.53%

7 Day CHG~0.00%

Published-12 Jan, 2022 | 17:30

Updated-16 Sep, 2024 | 17:58

Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File

A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.

Vendor-Palo Alto Networks, Inc.Microsoft Corporation

Product-cortex_xdr_agent windows Cortex XDR Agent

CWE ID-CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1097

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.74% / 75.38%

7 Day CHG~0.00%

Published-15 Jul, 2019 | 18:56

Updated-04 Aug, 2024 | 18:06

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1093.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1078

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-1.64% / 73.88%

7 Day CHG~0.00%

Published-14 Aug, 2019 | 20:55

Updated-20 Feb, 2026 | 21:18

Microsoft Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. An authenticated attacker could exploit this vulnerability by running a specially crafted application. The update addresses the vulnerability by correcting how the Windows Graphics Component handles objects in memory.

Product-windows_server_2016 windows_rt_8.1 windows_server_2012 windows_server_2008 windows_10 windows_8.1 windows_7 windows_server_2019 Windows 10 Version 1607 Windows Server 2019 (Server Core installation)Windows 10 Version 1903 for x64-based Systems Windows Server 2008 R2 Systems Service Pack 1 Windows 10 Version 1903 for ARM64-based Systems Windows Server 2008 Service Pack 2 Windows 10 Version 1809 Windows Server 2016 (Server Core installation)Windows 10 Version 1903 for 32-bit Systems Windows 8.1 Windows 7 Windows Server 2012 (Server Core installation)Windows Server, version 1803 (Server Core Installation)Windows 10 Version 1709 Windows 7 Service Pack 1 Windows Server 2016 Windows 10 Version 1507 Windows Server 2008 R2 Service Pack 1 Windows 10 Version 1803 Windows Server 2008 Service Pack 2 (Server Core installation)Windows Server 2008 R2 Service Pack 1 (Server Core installation)Windows Server 2012 R2 Windows Server 2019 Windows Server 2012 Windows Server 2008 Service Pack 2 Windows Server 2012 R2 (Server Core installation)Windows Server, version 1903 (Server Core installation)Windows 10 Version 1709 for 32-bit Systems Windows 10 Version 1703

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1096

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-4.83% / 91.04%

7 Day CHG~0.00%

Published-15 Jul, 2019 | 18:56

Updated-04 Aug, 2024 | 18:06

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2019-1073

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.65% / 84.01%

7 Day CHG~0.00%

Published-15 Jul, 2019 | 18:56

Updated-04 Aug, 2024 | 18:06

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8446

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.78% / 84.87%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8336, CVE-2018-8419, CVE-2018-8442, CVE-2018-8443, CVE-2018-8445.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows Server 2008 R2 Windows 10 Servers Windows Server 2012 R2 Windows Server 2016 Windows 10 Windows Server 2012 Windows 8.1 Windows 7 Windows RT 8.1 Windows Server 2008

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8127

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-3.01% / 86.00%

7 Day CHG~0.00%

Published-09 May, 2018 | 19:00

Updated-05 Aug, 2024 | 06:46

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8141.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows Server 2008 R2 Windows 10 Servers Windows Server 2012 R2 Windows 10 Windows Server 2012 Windows 8.1 Windows 7 Windows RT 8.1 Windows Server 2016

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8336

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.78% / 84.87%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8419, CVE-2018-8442, CVE-2018-8443, CVE-2018-8445, CVE-2018-8446.

Product-windows_7 windows_server_2008 Windows 7 Windows Server 2008 Windows Server 2008 R2

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8445

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.78% / 84.87%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8336, CVE-2018-8419, CVE-2018-8442, CVE-2018-8443, CVE-2018-8446.

Product-windows_server windows_10 Windows 10 Servers Windows 10

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8330

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.54% / 83.31%

7 Day CHG~0.00%

Published-10 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Server 2008 R2 Windows 10 Servers Windows Server 2012 R2 Windows Server 2016 Windows 10 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows 7 Windows RT 8.1 Windows Server 2008

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8442

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.78% / 84.87%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8454

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-3.28% / 87.12%

7 Day CHG~0.00%

Published-14 Nov, 2018 | 01:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

Product-windows_server_2016 windows_server_2019 windows_10 Windows 10 Servers Windows 10 Windows Server 2019

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8427

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.29% / 81.41%

7 Day CHG~0.00%

Published-10 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Windows Server 2008, Microsoft PowerPoint Viewer, Microsoft Excel Viewer.

Product-office_word_viewer office_365_proplus office excel_viewer office_compatibility_pack powerpoint_viewer windows_server_2008 Microsoft Excel Viewer Microsoft Office Word Viewer Microsoft Office Office Microsoft PowerPoint Viewer Windows Server 2008

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8271

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.78% / 84.87%

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:46

An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in memory, aka "Windows Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8472

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-18.87% / 96.99%

7 Day CHG~0.00%

Published-10 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 06:54

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Server 2008 R2 Windows 10 Servers Windows Server 2012 R2 Windows Server 2016 Windows 10 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows 7 Windows RT 8.1 Windows Server 2008

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-8565

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-3.18% / 86.69%

7 Day CHG~0.00%

Published-14 Nov, 2018 | 01:00

Updated-05 Aug, 2024 | 07:02

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-7295

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.71% / 84.43%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-06 May, 2026 | 22:30

The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information from process memory via a crafted application, aka "Windows Common Log File System Driver Information Disclosure Vulnerability."

Product-windows_10 windows_7 windows_8.1 windows_server_2008 windows_vista windows_server_2016 windows_rt_8.1 windows_server_2012 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-7220

Matching Score-10

Matching Score-10

CVSS Score-3.3||LOW

EPSS-3.27% / 87.11%

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-06 May, 2026 | 22:30

Virtual Secure Mode in Microsoft Windows 10 allows local users to obtain sensitive information via a crafted application, aka "Virtual Secure Mode Information Disclosure Vulnerability."

Product-windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-3251

Matching Score-10

Matching Score-10

CVSS Score-2.8||LOW

EPSS-58.07% / 98.99%

7 Day CHG~0.00%

Published-13 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerability."

Product-windows_10 windows_7 windows_8.1 windows_server_2008 windows_vista windows_rt_8.1 windows_server_2012 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2008-7292

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.38% / 30.97%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files, a different vulnerability than CVE-2011-2977.

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-windows bugzilla n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2012-2531

Matching Score-10

Matching Score-10

CVSS Score-2.1||LOW

EPSS-0.94% / 57.29%

7 Day CHG~0.00%

Published-14 Nov, 2012 | 00:00

Updated-29 Apr, 2026 | 01:13

Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability."

Product-windows_7 windows_server_2008 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-6266

Matching Score-10

Assigner-NVIDIA Corporation

Matching Score-10

Assigner-NVIDIA Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.31% / 23.14%

7 Day CHG~0.00%

Published-27 Nov, 2018 | 18:00

Updated-16 Sep, 2024 | 22:45

NVIDIA GeForce Experience contains a vulnerability in all versions prior to 3.16 on Windows where a local user may obtain third party integration parameters, which may lead to information disclosure.

Vendor-NVIDIA Corporation Microsoft Corporation

Product-windows geforce_experience GeForce Experience

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2008-2747

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.31% / 23.15%

7 Day CHG~0.00%

Published-18 Jun, 2008 | 19:00

Updated-23 Apr, 2026 | 00:35

No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.

Vendor-no-ip n/a Microsoft Corporation

Product-windows dynamic_update_client n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-4226

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.51% / 40.48%

7 Day CHG~0.00%

Published-08 Jun, 2018 | 18:00

Updated-05 Aug, 2024 | 05:11

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. watchOS before 4.3.1 is affected. The issue involves the "Security" component. It allows local users to bypass intended restrictions on the reading of sensitive user information.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-itunes iphone_os watchos mac_os_x windows icloud n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2020-12987

Matching Score-10

Assigner-Advanced Micro Devices Inc.

Matching Score-10

Assigner-Advanced Micro Devices Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.28% / 19.75%

7 Day CHG~0.00%

Published-11 Jun, 2021 | 21:50

Updated-17 Sep, 2024 | 01:02

A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass.

Vendor-Advanced Micro Devices, Inc.Microsoft Corporation

Product-radeon_software radeon_pro_software windows_10 AMD Radeon Software

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2008-3539

Matching Score-10

Assigner-MITRE Corporation

Product-hpsi_racf_connector hpsi_acf2_connector ibm_tivoli_dir_connector hpsi_sunone_connector hpsi_bidir_dirx_connector hpsi_topsecret_connector hpsi_edirectory_connector windows hpsi_openldap_connector hpsi_active_directory_connector hpsi_oid_connector hpsi_etrust_connector n/a

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.44% / 35.88%

7 Day CHG~0.00%

Published-10 Sep, 2008 | 15:00

Updated-23 Apr, 2026 | 00:35

Unspecified vulnerability in HP OpenView Select Identity (HPSI) Connectors on Windows, as used in HPSI Active Directory Connector 2.30 and earlier, HPSI SunOne Connector 1.14 and earlier, HPSI eDirectory Connector 1.12 and earlier, HPSI eTrust Connector 1.02 and earlier, HPSI OID Connector 1.02 and earlier, HPSI IBM Tivoli Dir Connector 1.02 and earlier, HPSI TOPSecret Connector 2.22.001 and earlier, HPSI RACF Connector 1.12.001 and earlier, HPSI ACF2 Connector 1.02 and earlier, HPSI OpenLDAP Connector 1.02 and earlier, and HPSI BiDir DirX Connector 1.00.003 and earlier, allows local users to obtain sensitive information via unknown vectors.

Vendor-n/a HP Inc.Microsoft Corporation

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-1685

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.39% / 31.91%

7 Day CHG~0.00%

Published-21 Sep, 2018 | 13:00

Updated-05 Aug, 2024 | 04:07

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.

Vendor-n/a IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows db2 linux_kernel n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-12224

Matching Score-10

Assigner-Intel Corporation

Matching Score-10

Assigner-Intel Corporation

CVSS Score-3.3||LOW

EPSS-0.34% / 26.47%

7 Day CHG~0.00%

Published-14 Mar, 2019 | 20:00

Updated-16 Sep, 2024 | 20:16

Buffer leakage in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may allow an authenticated user to potentially enable information disclosure via local access.

Vendor-Microsoft Corporation Intel Corporation

Product-graphics_driver windows Intel(R) Graphics Driver for Windows

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-0760

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.37% / 82.03%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 02:00

Updated-16 Sep, 2024 | 20:06

The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0755, CVE-2018-0761, and CVE-2018-0855.

Product-windows_7 windows_server_2012 windows_server_2008 Microsoft Windows Embedded OpenType (EOT) font engine

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-0755

Matching Score-10

Matching Score-10

CVSS Score-5.5||MEDIUM

EPSS-2.37% / 82.03%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 02:00

Updated-17 Sep, 2024 | 04:20

The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0760, CVE-2018-0761, and CVE-2018-0855.