ByteOS

Product:Office Outlook

Added At:06 Feb, 2025

Due At:27 Feb, 2025

Microsoft Outlook Improper Input Validation Vulnerability

Used in Ransomware

Unknown

CWE

CWE-20

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21413

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:13 Feb, 2024 | 18:02

Updated At:30 Jul, 2025 | 01:37

▼CVE Numbering Authority (CNA)

Microsoft Outlook Remote Code Execution Vulnerability

Affected Products

Vendor

Product

Microsoft Office 2019

Platforms

32-bit Systems
x64-based Systems

Versions

Affected

From 19.0.0 before https://aka.ms/OfficeSecurityReleases (custom)

Vendor

Microsoft 365 Apps for Enterprise

Product

Platforms

32-bit Systems
x64-based Systems

Versions

Affected

From 16.0.1 before https://aka.ms/OfficeSecurityReleases (custom)

Vendor

Microsoft Office LTSC 2021

Product

Platforms

x64-based Systems
32-bit Systems

Versions

Affected

From 16.0.1 before https://aka.ms/OfficeSecurityReleases (custom)

Vendor

Product

Microsoft Office 2016

Platforms

32-bit Systems
x64-based Systems

Versions

Affected

From 16.0.0 before 16.0.5435.1001 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20: Improper Input Validation

Type: CWE

CWE ID: CWE-20

Description: CWE-20: Improper Input Validation

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413	vendor-advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Metrics Other Info

kev

dateAdded:

2025-02-06

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21413

Timeline

Event	Date
CVE-2024-21413 added to CISA KEV	2025-02-06 00:00:00

Event: CVE-2024-21413 added to CISA KEV

Date: 2025-02-06 00:00:00

2. CVE Program Container

References

Hyperlink	Resource
https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script	N/A
https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script	N/A
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413	vendor-advisory x_transferred
https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/	x_transferred

Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script

Resource: N/A

Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script

Resource: N/A

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

Resource:

vendor-advisory

x_transferred

Hyperlink: https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/

Resource:

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:13 Feb, 2024 | 18:16

Updated At:29 May, 2025 | 16:32

Microsoft Outlook Remote Code Execution Vulnerability

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2025-02-06	2025-02-27	Microsoft Outlook Improper Input Validation Vulnerability	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Date Added: 2025-02-06

Due Date: 2025-02-27

Vulnerability Name: Microsoft Outlook Improper Input Validation Vulnerability

Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*

>>365_apps>>-

cpe:2.3:a:microsoft:office:2016:*:-:*:-:*:-:*

>>office>>2016

cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*

>>office>>2019

cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*

>>office_long_term_servicing_channel>>2021

Weaknesses

CWE ID	Type	Source
CWE-20	Secondary	secure@microsoft.com
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: CWE-20

Type: Secondary

Source: secure@microsoft.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413	secure@microsoft.com	Patch Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/	af854a3a-2127-422b-91ae-364da2661108	Technical Description
https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script	af854a3a-2127-422b-91ae-364da2661108	Exploit
https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script	af854a3a-2127-422b-91ae-364da2661108	Mitigation

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Technical Description

Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Hyperlink: https://www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mitigation

Similar CVEs

2013Records found

CVE-2020-3793

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-25.38% / 96.00%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 15:58

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and earlier have a use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2020-3745

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.55%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:47

Updated-04 Aug, 2024 | 07:44

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2020-3750

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.38% / 88.55%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:48

Updated-04 Aug, 2024 | 07:44

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2020-3740

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-8.03% / 91.75%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 14:51

Updated-04 Aug, 2024 | 07:44

Adobe Framemaker versions 2019.0.4 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Microsoft Corporation Adobe Inc.

Product-framemaker windows Adobe Framemaker

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-4660

Matching Score-8

Assigner-Forescout Technologies

Matching Score-8

Assigner-Forescout Technologies

CVSS Score-8.7||HIGH

EPSS-0.46% / 63.32%

7 Day CHG~0.00%

Published-13 May, 2025 | 17:34

Updated-21 Aug, 2025 | 15:14

Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access

A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based attacker to connect without authentication. By interacting with this pipe, an attacker can redirect the agent to communicate with a rogue server that can issue commands via the SecureConnector Agent. This does not impact Linux or OSX Secure Connector.

Vendor-Forescout Technologies, Inc.Microsoft Corporation

Product-secureconnector windows SecureConnector

CWE ID-CWE-276

Incorrect Default Permissions

CVE-2020-35769

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.43% / 61.94%

7 Day CHG~0.00%

Published-29 Dec, 2020 | 05:35

Updated-04 Aug, 2024 | 17:09

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

Vendor-n/a Microsoft Corporation Webmin

Product-webmin windows n/a

CVE-2022-42970

Matching Score-8

Assigner-Schneider Electric

Product-windows_server_2016 apc_easy_ups_online_monitoring_software easy_ups_online_monitoring_software windows_7 windows_11 windows_10 windows_server_2022 windows_server_2019 Schneider Electric Easy UPS Online Monitoring Software APC Easy UPS Online Monitoring Software

Matching Score-8

Assigner-Schneider Electric

CVSS Score-9.8||CRITICAL

EPSS-0.23% / 45.81%

7 Day CHG~0.00%

Published-01 Feb, 2023 | 00:00

Updated-05 Feb, 2025 | 20:17

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)

Vendor-Microsoft Corporation Schneider Electric SE

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2020-35712

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a Environmental Systems Research Institute, Inc. ("Esri")Microsoft Corporation Linux Kernel Organization, Inc

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.31% / 53.76%

7 Day CHG~0.00%

Published-25 Dec, 2020 | 23:46

Updated-04 Aug, 2024 | 17:09

Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

Product-windows linux_kernel arcgis_server n/a

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2020-0690

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-13.25% / 93.88%

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-04 Aug, 2024 | 06:11

An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.

Product-windows_server_2016 windows_server_2019 windows_10 Windows Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1903 for x64-based Systems Windows Server Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows Server, version 1909 (Server Core installation)Windows 10 Version 1903 for 32-bit Systems Windows Server, version 1903 (Server Core installation)Windows 10 Version 1909 for 32-bit Systems

CVE-2000-1218

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.22% / 83.83%

7 Day CHG~0.00%

Published-21 Apr, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts that it did not query, which allows remote attackers to poison the DNS cache.

Vendor-n/a Microsoft Corporation

Product-windows_98se windows_nt windows_xp windows_98 windows_2000 n/a

CWE ID-CWE-346

Origin Validation Error

CVE-2025-3944

Matching Score-8

Matching Score-8

CVSS Score-7.2||HIGH

EPSS-0.06% / 18.88%

7 Day CHG~0.00%

Published-22 May, 2025 | 12:44

Updated-04 Jun, 2025 | 19:27

Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Vendor-tridium Tridium Microsoft Corporation BlackBerry Limited Linux Kernel Organization, Inc

Product-niagara_enterprise_security qnx windows linux_kernel niagara Niagara Framework Niagara Enterprise Security

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2025-3940

Matching Score-8

Matching Score-8

CVSS Score-5.3||MEDIUM

EPSS-0.10% / 28.40%

7 Day CHG~0.00%

Published-22 May, 2025 | 12:35

Updated-04 Jun, 2025 | 19:28

Improper Use of Validation Framework

Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Vendor-tridium Tridium Microsoft Corporation BlackBerry Limited Linux Kernel Organization, Inc

Product-niagara_enterprise_security qnx windows linux_kernel niagara Niagara Framework Niagara Enterprise Security

CWE ID-CWE-1173

Improper Use of Validation Framework

CVE-2025-3938

Matching Score-8

Matching Score-8

CVSS Score-6.8||MEDIUM

EPSS-0.02% / 3.31%

7 Day CHG~0.00%

Published-22 May, 2025 | 12:32

Updated-04 Jun, 2025 | 19:29

Missing Cryptographic Step

Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Vendor-tridium Tridium Microsoft Corporation BlackBerry Limited Linux Kernel Organization, Inc

Product-niagara_enterprise_security qnx windows linux_kernel niagara Niagara Framework Niagara Enterprise Security

CWE ID-CWE-325

Missing Cryptographic Step

CWE ID-CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CVE-2020-26944

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.50% / 64.91%

7 Day CHG~0.00%

Published-16 Oct, 2020 | 13:11

Updated-04 Aug, 2024 | 16:03

An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely.

Vendor-aptean n/a Microsoft Corporation

Product-windows product_configurator n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2025-3941

Matching Score-8

Matching Score-8

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 19.05%

7 Day CHG~0.00%

Published-22 May, 2025 | 12:38

Updated-04 Jun, 2025 | 19:28

Improper Handling of Windows: DATA Alternate Data Stream

Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Vendor-tridium Tridium Microsoft Corporation

Product-niagara_enterprise_security niagara windows Niagara Framework Niagara Enterprise Security

CWE ID-CWE-69

Improper Handling of Windows ::DATA Alternate Data Stream

CWE ID-CWE-706

Use of Incorrectly-Resolved Name or Reference

CVE-2025-3937

Matching Score-8

Matching Score-8

CVSS Score-7.7||HIGH

EPSS-0.02% / 3.76%

7 Day CHG~0.00%

Published-22 May, 2025 | 12:23

Updated-04 Jun, 2025 | 19:52

Use of Password Hash with Insufficient Computational Effort

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.

Vendor-tridium Tridium Microsoft Corporation BlackBerry Limited Linux Kernel Organization, Inc

Product-niagara_enterprise_security qnx windows linux_kernel niagara Niagara Framework Niagara Enterprise Security

CWE ID-CWE-916

Use of Password Hash With Insufficient Computational Effort

CVE-2025-36038

Matching Score-8

Assigner-IBM Corporation

Vendor-IBM Corporation HP Inc.Microsoft Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-9||CRITICAL

EPSS-0.19% / 40.65%

7 Day CHG~0.00%

Published-25 Jun, 2025 | 20:38

Updated-26 Aug, 2025 | 14:51

IBM WebSphere Application Server code execution

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

Product-linux_kernel windows websphere_application_server aix solaris hp-ux i z\/os WebSphere Application Server

CWE ID-CWE-502

Deserialization of Untrusted Data

CVE-2020-0646

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-93.12% / 99.78%

7 Day CHG~0.00%

Published-14 Jan, 2020 | 23:11

Updated-30 Jul, 2025 | 01:45

Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

CWE ID-CWE-91

XML Injection (aka Blind XPath Injection)

CVE-2020-0609

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-86.50% / 99.37%

7 Day CHG-1.32%

Published-14 Jan, 2020 | 23:11

Updated-04 Aug, 2024 | 06:11

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.

Product-windows_server_2012 windows_server_2016 windows_server_2019 Windows Server

CVE-2020-0610

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-84.57% / 99.28%

7 Day CHG~0.00%

Published-14 Jan, 2020 | 23:11

Updated-04 Aug, 2024 | 06:11

Product-windows_server_2012 windows_server_2016 windows_server_2019 Windows Server

CVE-2020-0902

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-16.04% / 94.52%

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-04 Aug, 2024 | 06:18

An elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Service Fabric Elevation of Privilege'.

Product-service_fabric Service Fabric

CVE-2025-30387

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.15% / 36.88%

7 Day CHG~0.00%

Published-13 May, 2025 | 16:58

Updated-15 Jul, 2025 | 01:11

Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.

Product-azure_ai_document_intelligence_studio Azure AI Document Intelligence Studio

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2025-30392

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 29.68%

7 Day CHG~0.00%

Published-30 Apr, 2025 | 17:14

Updated-04 Jun, 2025 | 17:53

Azure AI bot Elevation of Privilege Vulnerability

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Product-azure_ai_bot_service Azure AI Bot Service

CWE ID-CWE-285

Improper Authorization

CVE-2025-30389

Matching Score-8

Matching Score-8

CVSS Score-8.7||HIGH

EPSS-0.06% / 18.89%

7 Day CHG~0.00%

Published-30 Apr, 2025 | 17:14

Updated-04 Jun, 2025 | 17:53

Azure Bot Framework SDK Elevation of Privilege Vulnerability

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Product-azure_ai_bot_service Azure AI Bot Service

CWE ID-CWE-285

Improper Authorization

CVE-2019-9855

Matching Score-8

Assigner-Document Foundation, The

Matching Score-8

Assigner-Document Foundation, The

CVSS Score-9.8||CRITICAL

EPSS-0.67% / 70.47%

7 Day CHG~0.00%

Published-06 Sep, 2019 | 18:40

Updated-16 Sep, 2024 | 18:49

Windows 8.3 path equivalence handling flaw allows LibreLogo script execution

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

Vendor-libreoffice Document Foundation openSUSE Microsoft Corporation

Product-windows libreoffice leap LibreOffice

CWE ID-CWE-417

Not Available

CVE-2025-29972

Matching Score-8

Matching Score-8

CVSS Score-9.9||CRITICAL

EPSS-0.31% / 53.52%

7 Day CHG~0.00%

Published-08 May, 2025 | 22:17

Updated-15 Jul, 2025 | 01:11

Azure Storage Resource Provider Spoofing Vulnerability

Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.

Product-azure_storage_resource_provider Azure Storage Resource Provider (SRP)

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2019-8221

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.62%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:26

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8199

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.64% / 90.00%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:23

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8195

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-29.78% / 96.47%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:20

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8213

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.62%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2025-29813

Matching Score-8

Matching Score-8

CVSS Score-10||CRITICAL

EPSS-0.15% / 35.70%

7 Day CHG~0.00%

Published-08 May, 2025 | 22:17

Updated-15 Jul, 2025 | 01:11

Azure DevOps Elevation of Privilege Vulnerability

[Spoofable identity claims] Authentication Bypass by Assumed-Immutable Data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Product-azure_devops Azure DevOps

CWE ID-CWE-302

Authentication Bypass by Assumed-Immutable Data

CWE ID-CWE-287

Improper Authentication

CVE-2019-8048

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-7.29% / 91.28%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:59

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8061

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:08

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8036

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:53

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-7965

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.06% / 88.07%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:31

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8024

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-35.34% / 96.92%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:47

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8023

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-16.16% / 94.55%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:44

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8041

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-39.72% / 97.21%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:56

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8030

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-30.10% / 96.50%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:51

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8029

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.17% / 89.51%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:49

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8025

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.17% / 89.51%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:47

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8197

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-39.72% / 97.21%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:23

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8098

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.06% / 88.07%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:24

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8071

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-0.65% / 69.88%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 18:03

Updated-04 Aug, 2024 | 21:10

Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Microsoft Corporation Adobe Inc.

Product-windows download_manager Adobe Download Manager

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2019-8060

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-13.38% / 93.92%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:07

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2019-8215

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.27% / 89.62%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:25

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8016

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-7.29% / 91.28%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:42

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8045

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-7.29% / 91.28%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:58

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8167

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.18% / 86.44%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:13

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8206

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-3.30% / 86.71%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:24

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .