CVSS: 4.9EPSS: 0%CPEs: 17EXPL: 0CVE-2013-1294
https://notcve.org/view.php?id=CVE-2013-1294
Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Kernel Race Condition Vulnerability." Condición de carrera en el kernel de Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, y R2 SP1, Windows 7 Gold y SP1, Windows 8, Windows Server 2012, y Windows RT, permite a usuarios locales elevar sus privilegio a través de una aplicación manipulada que aprovecha un manejo incorrecto de los objetos en memoria. Aka "Kernel Race Condition Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-100A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-031 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16257 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2013-1295
https://notcve.org/view.php?id=CVE-2013-1295
The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "CSRSS Memory Corruption Vulnerability." El subsistema Client/Server Run-time (CSRSS) en Microsoft Windows XP SP2 y SP3, Server 2003 SP2, Vista SP2, y Server 2008 SP2 no maneja adecuadamente los objetos en memoria, lo que permite a usuarios locales elevar sus privilegios a través de una aplicación manipulada. Aka "CSRSS Memory Corruption Vulnerability." • http://www.us-cert.gov/ncas/alerts/TA13-100A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-033 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16260 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 93%CPEs: 40EXPL: 0CVE-2013-0092 – Microsoft Internet Explorer GetMarkupPtr Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0092
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 6 a la 10, permite a atacantes remotos ejecutar código arbitrario a través de un sitio web diseñado que desencadena el acceso a un objeto eliminado, también conocido como "Internet Explorer GetMarkupPtr, vulnerabilidad de uso después de liberación". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the execCommand Print event. By manipulating a document's elements an attacker can force a dangling pointer to be reused after it has been freed. • http://www.us-cert.gov/ncas/alerts/TA13-071A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16324 • CWE-399: Resource Management Errors •
CVSS: 7.2EPSS: 0%CPEs: 16EXPL: 0CVE-2013-1286
https://notcve.org/view.php?id=CVE-2013-1286
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1287. Los controladores USB de modo kernel en Microsoft Windows XP SP2 y SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, y R2 SP1, Windows 7 Gold y SP1, Windows 8, y Windows Server 2012 no gestionan apropiadamente los objetos en memoria, lo que permite a atacantes físicamente próximos ejecutar código arbitrario mediante la conexión de un dispositivo USB manipulado, también conocido como "Windows USB Descriptor Vulnerability", una vulnerabilidad diferente de CVE-2013-1285 y CVE-2013-1287. • http://www.us-cert.gov/ncas/alerts/TA13-071A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-027 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16591 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 92%CPEs: 13EXPL: 0CVE-2013-1288
https://notcve.org/view.php?id=CVE-2013-1288
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CTreeNode Use After Free Vulnerability." Vulnerabilidad en la gestión de recursos en Microsoft Internet Explorer 8 permite a atacantes remotos ejecutar código arbitrario a través de un sitio web diseñado que desencadena el acceso a un objeto eliminado, también conocido como "Internet Explorer CTreeNode uso después de liberación". • http://www.us-cert.gov/ncas/alerts/TA13-071A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-021 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16095 • CWE-399: Resource Management Errors •