CVE-2020-1216 | ByteOS Network

Vulnerability Details :

CVE-2020-1216

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-09 Jun, 2020 | 19:43

Updated At-04 Aug, 2024 | 06:31

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1230, CVE-2020-1260.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:09 Jun, 2020 | 19:43

Updated At:04 Aug, 2024 | 06:31

▼CVE Numbering Authority (CNA)

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1230, CVE-2020-1260.

Affected Products

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 2004 for 32-bit Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 2004 for ARM64-based Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 9

Versions

Affected

Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2

Vendor

Microsoft Corporation

Product

Internet Explorer 11

Versions

Affected

Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2019
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1909 for 32-bit Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1909 for x64-based Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1909 for ARM64-based Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows Server 2012

Versions

Affected

unspecified

Vendor

Microsoft Corporation

Product

Internet Explorer 11 on Windows 10 Version 2004 for x64-based Systems

Versions

Affected

unspecified

Problem Types

Type	CWE ID	Description
text	N/A	Remote Code Execution

Type: text

CWE ID: N/A

Description: Remote Code Execution

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:secure@microsoft.com

Published At:09 Jun, 2020 | 20:15

Updated At:12 Jun, 2020 | 17:32

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1230, CVE-2020-1260.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	7.6	HIGH	AV:N/AC:H/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.6

Base severity: HIGH

Vector:

AV:N/AC:H/Au:N/C:C/I:C/A:C

CPE Matches

Microsoft Corporation

>>internet_explorer>>11

cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1607

cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1709

cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1803

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1809

cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1903

cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>1909

cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>2004

cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

Microsoft Corporation

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_rt_8.1>>-

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Microsoft Corporation

>>windows_server_2012>>-

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2012>>r2

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2016>>-

cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2019>>-

cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

Microsoft Corporation

>>internet_explorer>>9

cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>-

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1216

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

830Records found

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-15.98% / 94.60%

||

7 Day CHG~0.00%

Published-12 Apr, 2016 | 23:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0156 and CVE-2016-0157.

Vendor-n/a Microsoft Corporation

Product-edge n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-44.98% / 97.50%

||

7 Day CHG~0.00%

Published-09 Mar, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113.

Vendor-n/a Microsoft Corporation

Product-internet_explorer edge n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-27.07% / 96.25%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-internet_explorer edge n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-73.41% / 98.76%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-15.90% / 94.58%

||

7 Day CHG~0.00%

Published-09 Mar, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0129.

Vendor-n/a Microsoft Corporation

Product-edge n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-22.69% / 95.72%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The Microsoft (1) JScript 5.8 and (2) VBScript 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0189.

Vendor-n/a Microsoft Corporation

Product-internet_explorer vbscript jscript n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-78.67% / 99.01%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.37% / 95.97%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, and CVE-2017-11812.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-76.16% / 98.89%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-78.67% / 99.01%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11822.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_8.1 windows_rt_8.1 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.79% / 95.46%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11855.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-27.62% / 96.31%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 chakracore windows_rt_8.1 edge windows_10 internet_explorer ChakraCore, Microsoft Edge, Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-76.11% / 98.89%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, and CVE-2017-11871.

Vendor-Microsoft Corporation

Product-windows_server windows_server_2016 chakracore edge windows_10 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-73.99% / 98.79%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how Microsoft Edge handles objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability".

Vendor-Microsoft Corporation

Product-edge windows_10 Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how Internet Explorer handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.37% / 95.97%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allow an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.37% / 95.97%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-61.65% / 98.28%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

ChakraCore, and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affected system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-20.53% / 95.42%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11813.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-78.67% / 99.01%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.37% / 95.97%

||

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-73.99% / 98.79%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-80.40% / 99.09%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11871, and CVE-2017-11873.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.6||HIGH

EPSS-39.07% / 97.17%

||

7 Day CHG~0.00%

Published-07 Nov, 2007 | 20:00

Updated-07 Aug, 2024 | 15:01

Stack-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid UncompressedQuickTimeData opcode length in a PICT image.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-quicktime windows_xp windows_vista mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-80.40% / 99.09%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affected system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Vendor-n/a Microsoft Corporation

Product-edge windows_10 windows_server_2016 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.6||HIGH

EPSS-9.97% / 92.87%

||

7 Day CHG~0.00%

Published-18 Sep, 2007 | 19:00

Updated-07 Aug, 2024 | 15:17

Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry value.

Vendor-santa_cruz_operation mplayer windriver n/a Silicon Graphics, Inc.Apple Inc.IBM Corporation Microsoft Corporation Mandriva (Mandrakesoft)Linux Kernel Organization, Inc HP Inc.Sun Microsystems (Oracle Corporation)

Product-solaris windows_xp hp-ux mandrake_linux os2 aix mplayer windows_2000 windows_me linux_kernel bsdos windows_2003_server sco_unix mac_os_x tru64 windows_98 windows_nt irix n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-73.99% / 98.79%

||

7 Day CHG~0.00%

Published-12 Dec, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Vendor-Microsoft Corporation

Product-chakracore edge windows_10 windows_server_2016 ChakraCore, Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.33% / 95.96%

||

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Microsoft browsers handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server windows_server_2016 windows_8.1 windows_rt_8.1 windows_10 internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-57.80% / 98.11%

||

7 Day CHG~0.00%

Published-10 Jul, 2007 | 22:00

Updated-07 Aug, 2024 | 13:57

Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file involving the "denoting [of] the start of a Workspace designation", which results in memory corruption, aka the "Workbook Memory Corruption Vulnerability".

Vendor-n/a Microsoft Corporation

Product-excel excel_viewer n/a

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-23.75% / 95.87%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0108.

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 office windows_8.1 windows_rt_8.1 windows_10 Windows Graphics Component

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-26.15% / 96.17%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.

Vendor-Microsoft Corporation

Product-edge windows_10 windows_server_2016 Browser

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-16.01% / 94.60%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.

Vendor-Microsoft Corporation

Product-edge windows_10 windows_server_2016 Browser

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-0.18% / 39.67%

||

7 Day CHG~0.00%

Published-24 Jun, 2024 | 21:46

Updated-13 Feb, 2025 | 17:57

Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Fedora Project Microsoft Corporation Google LLC

Product-chrome windows fedora Chrome chrome

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-61.87% / 98.29%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, a.k.a. "Internet Explorer Memory Corruption Vulnerability."

Vendor-Microsoft Corporation

Product-internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-22.53% / 95.70%

||

7 Day CHG~0.00%

Published-08 Aug, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory, aka "Windows PDF Remote Code Execution Vulnerability".

Vendor-Microsoft Corporation

Product-windows_server_2008 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 edge windows_10 Microsoft Windows PDF

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-18.74% / 95.12%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." This vulnerability is different from that described in CVE-2017-0130.

Vendor-Microsoft Corporation

Product-internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-21.42% / 95.56%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0201.

Vendor-Microsoft Corporation

Product-edge Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-16.25% / 94.65%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." This vulnerability is different from that described in CVE-2017-0040.

Vendor-Microsoft Corporation

Product-internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-16.01% / 94.60%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.

Vendor-Microsoft Corporation

Product-edge windows_10 windows_server_2016 Browser

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-7.5||HIGH

EPSS-0.25% / 47.56%

||

7 Day CHG~0.00%

Published-24 Jun, 2024 | 21:46

Updated-13 Feb, 2025 | 17:54

Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor-Fedora Project Microsoft Corporation Google LLC

Product-chrome windows fedora Chrome chrome

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-24.01% / 95.90%

||

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0222.

Vendor-Microsoft Corporation

Product-internet_explorer Internet Explorer

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-29.43% / 96.48%

||

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0221 and CVE-2017-0227.

Vendor-Microsoft Corporation

Product-edge Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-55.57% / 98.01%

||

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0238.

Vendor-Microsoft Corporation

Product-edge Microsoft Edge

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-32.46% / 96.74%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.

Vendor-Microsoft Corporation

Product-edge windows_10 windows_server_2016 Browser

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.5||HIGH

EPSS-27.88% / 96.34%

||

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."

Vendor-Microsoft Corporation

Product-windows_server_2012 windows_8.1 windows_rt_8.1 edge windows_10 PDF

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer