Page 19 of 431 results (0.007 seconds)

CVSS: 6.9EPSS: 0%CPEs: 14EXPL: 1

CVE-2013-5058 – Microsoft Windows Kernel - 'win32k.sys' Integer Overflow (MS13-101)

https://notcve.org/view.php?id=CVE-2013-5058

Integer overflow in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows local users to gain privileges via a crafted application, aka "Win32k Integer Overflow Vulnerability." Desbordamiento de enteros en los controladores en modo kernel de Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1 y Windows Server 2012 Gold y R2 permite a usuarios locales conseguir privilegios a través de una aplicación manipulada, conocido como "Vulnerabilidad de desbordamiento de enteros en Win32k." • https://www.exploit-db.com/exploits/30397 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-101 • CWE-190: Integer Overflow or Wraparound •

CVSS: 7.6EPSS: 73%CPEs: 24EXPL: 2

CVE-2013-3900 – Microsoft WinVerifyTrust function Remote Code Execution

https://notcve.org/view.php?id=CVE-2013-3900

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability." La función WinVerifyTrust en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2 y Windows RT Gold y 8.1 no valida correctamente los digest de archivos PE durante la verificación de la firma Authenticode, que permite a atacantes remotos ejecutar código arbitrario mediante un archivo PE manipulado, también conocido como "WinVerifyTrust firma vulnerabilidad de validación." A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. • https://github.com/snoopopsec/vulnerability-CVE-2013-3900 https://github.com/Securenetology/CVE-2013-3900 http://blogs.technet.com/b/srd/archive/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode.aspx https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-098 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900 • CWE-20: Improper Input Validation •

CVSS: 7.1EPSS: 0%CPEs: 15EXPL: 0

CVE-2013-3876

https://notcve.org/view.php?id=CVE-2013-3876

DirectAccess in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify server X.509 certificates, which allows man-in-the-middle attackers to spoof servers and read encrypted domain credentials via a crafted certificate. DirectAccess en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP1 y SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 no verifica adecuadamente certificados X.509 del servidor, lo que permite a atacantes man-in-the-middle falsificar servidores y leer credenciales de dominio cifradas a través de un certificado manipulado. • http://technet.microsoft.com/security/advisory/2862152 • CWE-20: Improper Input Validation •

CVSS: 9.3EPSS: 95%CPEs: 14EXPL: 0

CVE-2013-3940

https://notcve.org/view.php?id=CVE-2013-3940

Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image in a Windows Write (.wri) document, which is not properly handled in WordPad, aka "Graphics Device Interface Integer Overflow Vulnerability." Desbordamiento de entero en la interfaz de dispositivo gráfico (GDI) de Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Oro y R2 y Windows RT oro y 8.1 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de una imagen manipulada en un documento Windows Write (. wRI) , que no es manejada correctamente en WordPad, también conocidos como gráficos "Graphics Device Interface Integer Overflow Vulnerability". • http://www.us-cert.gov/ncas/alerts/TA13-317A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-089 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18722 • CWE-190: Integer Overflow or Wraparound •

CVSS: 5.0EPSS: 5%CPEs: 14EXPL: 0

CVE-2013-3869

https://notcve.org/view.php?id=CVE-2013-3869

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to cause a denial of service (daemon hang) via a web-service request containing a crafted X.509 certificate that is not properly handled during validation, aka "Digital Signatures Vulnerability." Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, y Windows RT Gold y 8.1 permite a atacantes remotos provocar una denegación de servicio (cuelgue del demonio) a través de una petición web-service conteniendo un certificado X.509 manipulado que no es manejado adecuadamente durante la validación, también conocida como "Vulnerabilidad de Firmas Digitales". • http://www.us-cert.gov/ncas/alerts/TA13-317A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-095 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19112 • CWE-20: Improper Input Validation •