CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11786
https://notcve.org/view.php?id=CVE-2017-11786
Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Business Elevation of Privilege Vulnerability." Skype for Business en Microsoft Lync 2013 SP1 y Skype for Business 2016 permiten que un atacante robe un hash de autenticación que puede reutilizarse en otro sitio, debido a la forma en la que Skype for Business gestiona las peticiones de autenticación, lo que también se conoce como "Skype for Business Elevation of Privilege Vulnerability". • http://www.securityfocus.com/bid/101156 http://www.securitytracker.com/id/1039530 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11786 • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 7.6EPSS: 9%CPEs: 13EXPL: 0CVE-2017-8696
https://notcve.org/view.php?id=CVE-2017-8696
Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to execute code remotely via a specially crafted website or a specially crafted document or email attachment, aka "Microsoft Graphics Component Remote Code Execution." El componente Uniscribe de Windows en Microsoft Windows Server 2008 SP2 y R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 y 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee y Live Meeting 2007 Add-in y Console permite que un atacante ejecute código remotamente mediante una página web, un documento o archivo de correo adjunto especialmente manipulados. Esto también se conoce como "Microsoft Graphics Component Remote Code Execution". • http://www.securityfocus.com/bid/100780 http://www.securitytracker.com/id/1039344 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8696 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 1%CPEs: 21EXPL: 0CVE-2017-8695
https://notcve.org/view.php?id=CVE-2017-8695
Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to obtain information to further compromise a user's system via a specially crafted document or an untrusted webpage, aka "Graphics Component Information Disclosure Vulnerability." El componente Uniscribe de Windows en Microsoft Windows Server 2008 SP2 y R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold y R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703 y Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office para Mac 2011 y 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; y Live Meeting 2007 Add-in y Console permite que un atacante obtenga información para comprometer posteriormente el sistema de un usuario mediante un documento especialmente manipulado o una página web no fiable. Esto también se conoce como "Graphics Component Information Disclosure Vulnerability". • http://www.securityfocus.com/bid/100773 http://www.securitytracker.com/id/1039344 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8695 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.3EPSS: 2%CPEs: 22EXPL: 0CVE-2017-8676 – Microsoft Windows Bitmap Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-8676
The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability." La interfaz Graphics Device Interface (GDI) de Windows en Microsoft Windows Server 2008 SP2 y R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold y R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703 y Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office para Mac 2011 y 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; y Live Meeting 2007 Add-in y Console permite que un atacante autenticado recupere información de un sistema objetivo mediante una aplicación especialmente manipulada. Esto también se conoce como "Windows GDI+ Information Disclosure Vulnerability." This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of bitmap image data in graphics files. • http://www.securityfocus.com/bid/100755 http://www.securitytracker.com/id/1039333 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8676 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 40%CPEs: 18EXPL: 1CVE-2017-0283 – Microsoft Windows - 'USP10!MergeLigRecords' Uniscribe Font Processing Heap Memory Corruption
https://notcve.org/view.php?id=CVE-2017-0283
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, Skype for Business 2016, Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows, and Microsoft Silverlight 5 when installed on Microsoft Windows allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Uniscribe Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8528. Uniscribe en Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, Skype for Business 2016, Microsoft Silverlight 5 Developer Runtime cuando se instala en Microsoft Windows y Microsoft Silverlight 5 cuando se instala en Microsoft Windows permite una vulnerabilidad de ejecución remota de código debido a la forma en que maneja objetos en la memoria , También conocido como "Windows Uniscribe Remote Code Execution Vulnerability". Este CVE ID es exclusivo de CVE-2017-8528. Microsoft Windows suffers from a Uniscribe font processing heap-based memory corruption vulnerability in USP10! • https://www.exploit-db.com/exploits/42234 http://www.securityfocus.com/bid/98920 http://www.securitytracker.com/id/1038675 https://0patch.blogspot.com/2017/07/0patching-quick-brown-fox-of-cve-2017.html https://bugs.chromium.org/p/project-zero/issues/detail?id=1198 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0283 •