ByteOS

Product

Windows 10

Versions

Affected

Version 1709 for 32-bit Systems
Version 1709 for x64-based Systems

Vendor

Product

Windows 10 Servers

Versions

Affected

version 1709 (Server Core Installation)

Problem Types

Type	CWE ID	Description
text	N/A	Information Disclosure

Type: text

CWE ID: N/A

Description: Information Disclosure

References

Hyperlink	Resource
http://www.securitytracker.com/id/1040849	vdb-entry x_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141	x_refsource_CONFIRM
http://www.securityfocus.com/bid/104078	vdb-entry x_refsource_BID

Hyperlink: http://www.securitytracker.com/id/1040849

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/104078

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.securitytracker.com/id/1040849	vdb-entry x_refsource_SECTRACK x_transferred
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/104078	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://www.securitytracker.com/id/1040849

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/104078

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:09 May, 2018 | 19:29

Updated At:13 Jun, 2018 | 14:11

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	4.7	MEDIUM	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	1.9	LOW	AV:L/AC:M/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 4.7

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 1.9

Base severity: LOW

Vector:

AV:L/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*

>>windows_10>>1709

cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:*

>>windows_server_2016>>1709

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

CWE ID: CWE-200

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/104078	secure@microsoft.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040849	secure@microsoft.com	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/104078

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1040849

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8141

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

1005Records found

CVE-2018-0894

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-11.70% / 93.42%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 17:09

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, CVE-2018-0901 and CVE-2018-0926.

Product-windows_server windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows kernel

CWE ID-CWE-824

Access of Uninitialized Pointer

CWE ID-CWE-125

Out-of-bounds Read

CVE-2018-0832

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-11.70% / 93.42%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 02:00

Updated-16 Sep, 2024 | 18:59

The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how objects in memory are handled, aka "Windows Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0829 and CVE-2018-0830.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_10 Windows

CWE ID-CWE-401

Missing Release of Memory after Effective Lifetime

CVE-2018-0747

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-0.49% / 64.67%

7 Day CHG~0.00%

Published-04 Jan, 2018 | 14:00

Updated-17 Sep, 2024 | 00:01

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0745 and CVE-2018-0746.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows kernel

CVE-2018-0757

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-1.71% / 81.56%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 02:00

Updated-16 Sep, 2024 | 19:40

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0810.

Product-windows_server windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows

CVE-2018-0964

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-0.53% / 66.41%

7 Day CHG~0.00%

Published-12 Apr, 2018 | 01:00

Updated-05 Aug, 2024 | 03:44

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This affects Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-0957.

Product-windows_server_2016 windows_10 Windows 10 Servers Windows 10

CVE-2018-0745

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-6.73% / 90.89%

7 Day CHG~0.00%

Published-04 Jan, 2018 | 14:00

Updated-16 Sep, 2024 | 23:06

The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an information disclosure vulnerability due to the way objects are handled in memory, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0746 and CVE-2018-0747.

Product-windows_server_2016 windows_10 Windows kernel

CWE ID-CWE-665

Improper Initialization

CVE-2018-0901

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-11.24% / 93.24%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 17:43

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0926.

Product-windows_server windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows kernel

CWE ID-CWE-401

Missing Release of Memory after Effective Lifetime

CWE ID-CWE-665

Improper Initialization

CVE-2018-0810

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-2.06% / 83.16%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 02:00

Updated-17 Sep, 2024 | 00:56

The Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2, and Windows Server 2012 allows an information disclosure vulnerability due to the way memory is initialized, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0757.

Product-windows_7 windows_server_2012 windows_server_2008 Windows

CWE ID-CWE-665

Improper Initialization

CVE-2018-0746

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-2.43% / 84.54%

7 Day CHG~0.00%

Published-04 Jan, 2018 | 14:00

Updated-17 Sep, 2024 | 01:06

The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0745 and CVE-2018-0747.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_10 Windows kernel

CWE ID-CWE-665

Improper Initialization

CVE-2016-3685

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.7||MEDIUM

EPSS-0.05% / 15.55%

7 Day CHG~0.00%

Published-14 Dec, 2016 | 22:00

Updated-12 Apr, 2025 | 10:46

SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of a hardcoded key in the program code and a computer BIOS serial number, aka SAP Security Note 2282338.

Vendor-n/a Apple Inc.SAP SE Microsoft Corporation

Product-download_manager windows macos n/a

CWE ID-CWE-798

Use of Hard-coded Credentials

CVE-2002-2283

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-1.9||LOW

EPSS-1.92% / 82.60%

7 Day CHG~0.00%

Published-18 Oct, 2007 | 10:00

Updated-03 Apr, 2025 | 01:03

Microsoft Windows XP with Fast User Switching (FUS) enabled does not remove the "show processes from all users" privilege when the user is removed from the administrator group, which allows that user to view processes of other users.

Product-windows_xp n/a

CVE-2018-0897

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-3.71% / 87.50%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 18:48

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, CVE-2018-0901 and CVE-2018-0926.

Product-windows_server windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows kernel

CWE ID-CWE-665

Improper Initialization

CVE-2021-23219

Matching Score-8

Assigner-NVIDIA Corporation

Product-geforce_gtx_690 geforce_gtx_760 geforce_gt_625 quadro_t1000 geforce_gtx_1050_ti quadro_rtx_6000 quadro_m620 quadro_m5500 geforce_gtx_1660_super quadro_m6000 quadro_p1000 geforce_rtx_2060_super geforce_gt_730 nvidia_t1000 quadro_p4000 dgx-1_v100 jetson_agx_xavier_8gb tesla_m10 geforce_gtx_760_ti jetson_xavier_nx geforce_rtx_2070_super geforce_gt_620 geforce_gtx_745 quadro_m3000m geforce_gtx_1080_ti geforce_gtx_660 geforce_gtx_1060 quadro_p4200 geforce_gtx_780 jetson_nano geforce_gtx_750_ti geforce_gtx_1660 quadro_m4000 geforce_rtx_2080_super geforce_gtx_950 quadro_t2000 jetson_tx1 nvidia_t600 quadro_rtx_3000 nvidia_t400 tesla_v100s tesla_p6 geforce_gtx_titan_x tesla_m40 quadro_m2200 quadro_t400 quadro_gv100 geforce_gt_630 geforce_gt_635 geforce_gtx_770 geforce_gtx_645 geforce_gtx_1650 jetson_agx_xavier_32gb quadro_m600m nvidia_t2000 quadro_p3000 quadro_m4000m shield_tv geforce_gtx_980 tesla_p40 geforce_rtx_2080_ti gtx_titan geforce_gtx_650 titan_v dgx_station_a100 geforce_gtx_670 quadro_m2000m quadro_p2000 quadro_m520 gtx_titan_black quadro_m5000 geforce_gtx_750 geforce_gt_720 quadro_p400 quadro_m1200 quadro_p5000 tesla_m4 geforce_gtx_1050 tesla_v100 geforce_gt_710 geforce_gtx_650_ti_boost jetson_tx2i quadro_p6000 geforce_gt_610 nvidia_t4 quadro_t600 geforce_gtx_780_ti geforce_gtx_650_ti geforce_gtx_1660_ti geforce_gt_705 quadro_p620 quadro_rtx_8000 titan_xp geforce_gtx_660_ti jetson_tx2_nx geforce_gtx_1070 shield_tv_pro geforce_gt_740 geforce_gt_605 nvidia_hgx-2 geforce_gtx_960 quadro_m500m quadro_p5200 linux_kernel quadro_p3200 quadro_p600 quadro_m1000m quadro_p2200 geforce_gtx_1650_super quadro_m5000m quadro_rtx_4000 jetson_tx2 dgx-2 tesla_p4 quadro_p500 geforce_gtx_680 quadro_p520 drive_constellation geforce_rtx_2070 titan_x geforce_gtx_970 jetson_tx2_4gb titan_rtx tesla_p100 geforce_gt_640 tesla_m60 quadro_rtx_5000 geforce_gtx_1080 geforce_rtx_2060 geforce_gtx_1070_ti tesla_m6 gtx_titan_z jetson_agx_xavier_16gb windows quadro_m2000 dgx-1_p100 geforce_rtx_2080 NVIDIA GPU and Tegra hardware

Matching Score-8

Assigner-NVIDIA Corporation

CVSS Score-4.1||MEDIUM

EPSS-0.05% / 16.15%

7 Day CHG~0.00%

Published-20 Nov, 2021 | 14:55

Updated-03 Aug, 2024 | 19:05

NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to access protected information by identifying, exploiting, and loading vulnerable microcode. Such an attack may lead to information disclosure.

Vendor-NVIDIA Corporation Linux Kernel Organization, Inc Microsoft Corporation

CVE-2019-10210

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6.7||MEDIUM

EPSS-0.28% / 51.17%

7 Day CHG~0.00%

Published-29 Oct, 2019 | 00:00

Updated-04 Aug, 2024 | 22:17

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.

Vendor-The PostgreSQL Global Development Group Microsoft Corporation

Product-windows postgresql postgresql

CWE ID-CWE-522

Insufficiently Protected Credentials

CVE-2019-0775

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-0.35% / 56.58%

7 Day CHG~0.00%

Published-09 Apr, 2019 | 02:11

Updated-04 Aug, 2024 | 17:58

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0782.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Windows Server

CVE-2019-0600

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-0.40% / 59.69%

7 Day CHG~0.00%

Published-06 Mar, 2019 | 00:00

Updated-04 Aug, 2024 | 17:51

An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0601.

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Windows Server

CVE-2018-8506

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-18.62% / 95.02%

7 Day CHG~0.00%

Published-10 Oct, 2018 | 13:00

Updated-05 Aug, 2024 | 06:54

An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft Windows Codecs Library Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

Product-windows_server_2016 windows_server_2019 windows_10 Windows 10 Servers Windows 10 Windows Server 2019

CVE-2018-8121

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-1.16% / 77.72%

7 Day CHG~0.00%

Published-14 Jun, 2018 | 12:00

Updated-05 Aug, 2024 | 06:46

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10. This CVE ID is unique from CVE-2018-8207.

Product-windows_server_2016 windows_10 Windows 10 Servers Windows 10

CWE ID-CWE-665

Improper Initialization

CVE-2019-0601

Matching Score-8

Matching Score-8

CVSS Score-4.7||MEDIUM

EPSS-0.55% / 66.94%

7 Day CHG~0.00%

Published-06 Mar, 2019 | 00:00

Updated-04 Aug, 2024 | 17:51

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2019 windows_server_2008 Windows Windows Server

CVE-2021-26444

Matching Score-8

Matching Score-8

CVSS Score-3.3||LOW

EPSS-1.05% / 76.62%

7 Day CHG~0.00%

Published-10 Nov, 2021 | 00:46

Updated-03 Aug, 2024 | 20:26

Azure RTOS Information Disclosure Vulnerability

Product-azure_real_time_operating_system Azure Real Time Operating System

CVE-2010-1406

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.76% / 72.38%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2018-21026

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.47% / 63.48%

7 Day CHG~0.00%

Published-12 Nov, 2019 | 17:42

Updated-05 Aug, 2024 | 12:19

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.

Vendor-n/a Oracle Corporation Linux Kernel Organization, Inc Hitachi, Ltd.Microsoft Corporation

Product-solaris linux_kernel compute_systems_manager windows tuning_manager replication_manager device_manager tiered_storage_manager n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-1079

Matching Score-6

Matching Score-6

CVSS Score-7.5||HIGH

EPSS-1.38% / 79.55%

7 Day CHG~0.00%

Published-11 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1092.

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-acrobat_reader_dc acrobat_dc reader windows acrobat mac_os_x n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2010-1258

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.70% / 95.93%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Microsoft Internet Explorer 6, 7, and 8 does not properly determine the origin of script code, which allows remote attackers to execute script in an unintended domain or security zone, and obtain sensitive information, via unspecified vectors, aka "Event Handler Cross-Domain Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0012

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-13.31% / 93.91%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."

Product-visio excel office powerpoint word visual_basics n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0079

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-2.61% / 85.06%

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."

Product-windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0125

Matching Score-6

Matching Score-6

CVSS Score-3.1||LOW

EPSS-4.49% / 88.68%

7 Day CHG~0.00%

Published-09 Mar, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Disclosure Vulnerability."

Product-edge n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-3262

Matching Score-6

Matching Score-6

CVSS Score-5.5||MEDIUM

EPSS-19.06% / 95.10%

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Console allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "GDI+ Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3263.

Product-live_meeting windows_7 windows_server_2008 word_viewer lync windows_rt_8.1 skype_for_business windows_vista office windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0149

Matching Score-6

Matching Score-6

CVSS Score-5.9||MEDIUM

EPSS-15.75% / 94.46%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."

Product-.net_framework n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0008

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-12.91% / 93.79%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows GDI32.dll ASLR Bypass Vulnerability."

Product-windows_rt windows_7 windows_8 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0138

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-15.24% / 94.35%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0047

Matching Score-6

Matching Score-6

CVSS Score-7.5||HIGH

EPSS-23.28% / 95.73%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data, aka "Windows Forms Information Disclosure Vulnerability."

Product-.net_framework n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0080

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-15.17% / 94.34%

7 Day CHG+1.68%

Published-10 Feb, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge ASLR Bypass."

Product-edge n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0059

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-17.58% / 94.83%

7 Day CHG-2.46%

Published-10 Feb, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information Disclosure Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0075

Matching Score-6

Matching Score-6

CVSS Score-5.5||MEDIUM

EPSS-5.87% / 90.22%

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0073.

Product-windows_server_2012 windows_8.1 windows_10 windows_rt_8.1 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0190

Matching Score-6

Matching Score-6

CVSS Score-5.5||MEDIUM

EPSS-2.39% / 84.41%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Volume Manager Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 does not properly check whether RemoteFX RDP USB disk accesses originate from the user who mounted a disk, which allows local users to read arbitrary files on these disks via RemoteFX requests, aka "Remote Desktop Protocol Drive Redirection Information Disclosure Vulnerability."

Product-windows_server_2012 windows_8.1 windows_rt_8.1 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0073

Matching Score-6

Matching Score-6

CVSS Score-5||MEDIUM

EPSS-2.61% / 85.06%

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Product-windows_server_2012 windows_8.1 windows_10 windows_rt_8.1 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0090

Matching Score-6

Matching Score-6

CVSS Score-7.1||HIGH

EPSS-0.71% / 71.30%

7 Day CHG~0.00%

Published-12 Apr, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

Product-windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0175

Matching Score-6

Matching Score-6

CVSS Score-3.3||LOW

EPSS-0.75% / 72.10%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses, and consequently bypass the KASLR protection mechanism, via a crafted application, aka "Win32k Information Disclosure Vulnerability."

Product-windows_7 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2010-1796

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-2.6||LOW

EPSS-0.36% / 57.16%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

The AutoFill feature in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to obtain sensitive Address Book Card information via JavaScript code that forces keystroke events for input fields.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0194

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-0.91% / 74.84%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0287

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-7.8||HIGH

EPSS-0.03% / 5.79%

7 Day CHG~0.00%

Published-08 Jul, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors.

Vendor-n/a IBM Corporation Microsoft Corporation

Product-windows i_access n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0958

Matching Score-6

Matching Score-6

CVSS Score-7.5||HIGH

EPSS-0.64% / 69.71%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-windows linux_kernel mac_os_x experience_manager n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0089

Matching Score-6

Matching Score-6

CVSS Score-7.1||HIGH

EPSS-0.92% / 75.06%

7 Day CHG~0.00%

Published-12 Apr, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

Product-windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0028

Matching Score-6

Matching Score-6

CVSS Score-5.5||MEDIUM

EPSS-21.12% / 95.45%

7 Day CHG-0.25%

Published-16 Jun, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."

Product-exchange_server outlook_web_access n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0168

Matching Score-6

Matching Score-6

CVSS Score-6.5||MEDIUM

EPSS-69.65% / 98.60%

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0169.

Product-windows_7 windows_server_2008 windows_rt_8.1 windows_vista windows_server_2012 windows_8.1 windows_10 n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-0793

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-7.5||HIGH

EPSS-32.17% / 96.68%

7 Day CHG~0.00%

Published-01 Apr, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

Vendor-n/a Red Hat, Inc.Microsoft Corporation

Product-windows jboss_wildfly_application_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2010-1393

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 79.61%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to discover sensitive URLs via an HREF attribute associated with a redirecting URL.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2016-3391

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-25.02% / 95.96%

7 Day CHG~0.00%

Published-14 Oct, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow context-dependent attackers to discover credentials by leveraging access to a memory dump, aka "Microsoft Browser Information Disclosure Vulnerability."

Product-internet_explorer edge n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2015-8453

Matching Score-6

Matching Score-6