CVSS: 10.0EPSS: 65%CPEs: 37EXPL: 0CVE-2015-2435 – Microsoft Windows TrueType Font Pool Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-2435
11 Aug 2015 — Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Silverlight before 5.1.40728 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Serve... • http://www.securityfocus.com/bid/76238 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 7%CPEs: 37EXPL: 2CVE-2015-2455 – Microsoft Windows TrueType Fonts Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-2455
11 Aug 2015 — Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerabi... • https://packetstorm.news/files/id/133188 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2015-1672
https://notcve.org/view.php?id=CVE-2015-1672
13 May 2015 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2 permite a atacantes remotos causar una denegación de servicio (recursión y degradación de funcionamiento) a través de datos cifrados manipulados en una documento XML documen... • http://www.securityfocus.com/bid/74482 • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 0CVE-2015-1670
https://notcve.org/view.php?id=CVE-2015-1670
13 May 2015 — The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability." La librería de Windows DirectWrite, utilizado en Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2, permite a atacantes remotos obtener información sensible de la memoria de procesos a través de una fuente OpenType ... • http://www.securityfocus.com/bid/74485 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 71%CPEs: 8EXPL: 0CVE-2015-1673
https://notcve.org/view.php?id=CVE-2015-1673
13 May 2015 — The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability." Las librerías Windows Forms (también conocidas como WinForms) en Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2 permiten a atacantes remotos asistidos por usuarios ejecutar código arbitrario a ... • http://www.securityfocus.com/bid/74487 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 89%CPEs: 25EXPL: 0CVE-2015-1671 – Microsoft Windows Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-1671
13 May 2015 — The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability." La librería DirectWrite de Windows, utilizada en Microsoft... • http://www.securityfocus.com/bid/74490 •
CVSS: 7.5EPSS: 94%CPEs: 8EXPL: 0CVE-2015-1648
https://notcve.org/view.php?id=CVE-2015-1648
14 Apr 2015 — ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability." ASP.NET en Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2, cuando la configuración customErrors está deshabilitada, permite a atacantes remotos obtener información sensible de los ficheros d... • http://www.securitytracker.com/id/1032116 • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 63%CPEs: 8EXPL: 1CVE-2014-4149 – ExploitRemotingService .NET Tool
https://notcve.org/view.php?id=CVE-2014-4149
11 Nov 2014 — Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka "TypeFilterLevel Vulnerability." Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2 no realiza debidamente las comprobaciones TypeFilterLevel, lo que permite a atacantes remotos ejecutar código arbitrario a través de datos manipulados en un endpoint... • https://packetstorm.news/files/id/129165 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 10%CPEs: 5EXPL: 0CVE-2014-4075
https://notcve.org/view.php?id=CVE-2014-4075
15 Oct 2014 — Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability." Vulnerabilidad de XSS en System.Web.Mvc.dll en Microsoft ASP.NET Model View Controller (MVC) 2.0 hasta 5.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una página web manipulada, también conocido como 'vulnerabilidad d... • http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 7EXPL: 0CVE-2014-4073
https://notcve.org/view.php?id=CVE-2014-4073
15 Oct 2014 — Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to gain privileges via vectors involving Internet Explorer, aka ".NET ClickOnce Elevation of Privilege Vulnerability." Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, y 4.5.2 procesa datos no verificados durante la interacción con el instalador ClickOnce, lo que permite a atacantes remotos ganar privilegios a través de ve... • http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability.aspx • CWE-264: Permissions, Privileges, and Access Controls •