| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI. |
| Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. |
| The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. |
| An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. |
| Windows libarchive Remote Code Execution Vulnerability |
| Microsoft Defender Remote Code Execution Vulnerability |
| Windows Win32k Elevation of Privilege Vulnerability |
| Internet Explorer Memory Corruption Vulnerability |
| Internet Explorer Remote Code Execution Vulnerability |
| Win32k Elevation of Privilege Vulnerability |
| HTTP Protocol Stack Remote Code Execution Vulnerability |
| Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability |
| Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability |
| Windows Kernel Information Disclosure Vulnerability |
| Microsoft DWM Core Library Elevation of Privilege Vulnerability |
| Windows Mark of the Web Security Feature Bypass Vulnerability |
| Windows CNG Key Isolation Service Elevation of Privilege Vulnerability |
| Windows Mark of the Web Security Feature Bypass Vulnerability |
| Windows Print Spooler Elevation of Privilege Vulnerability |
