{"meta":{"title":"KEV entries: Microsoft","description":"All KEV entries for vendor Microsoft.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":388,"vendor":"Microsoft","entries":388,"shareOfCatalogPercent":22.5,"ransomwareKnown":117,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-09-08","rank":1},"data":[{"cveID":"CVE-2026-85880","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","dateAdded":"2026-09-08","dueDate":"2026-09-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122","CWE-908"],"shortDescription":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85880","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-85880/"},{"cveID":"CVE-2026-81963","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Link Following Vulnerability","dateAdded":"2026-09-08","dueDate":"2026-09-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-59","CWE-284"],"shortDescription":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81963","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-81963/"},{"cveID":"CVE-2019-1068","vendorProject":"Microsoft","product":"SQL Server","vulnerabilityName":"Microsoft SQL Server Remote Code Execution Vulnerability","dateAdded":"2026-08-26","dueDate":"2026-08-29","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2019-1068","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2019-1068/"},{"cveID":"CVE-2026-55040","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Weak Authentication Vulnerability","dateAdded":"2026-08-18","dueDate":"2026-08-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1390"],"shortDescription":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-55040/"},{"cveID":"CVE-2026-33824","vendorProject":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","vulnerabilityName":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","dateAdded":"2026-08-18","dueDate":"2026-08-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-415"],"shortDescription":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-33824","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-33824/"},{"cveID":"CVE-2026-68820","vendorProject":"Microsoft","product":"Windows Ancillary Function Driver for WinSock ","vulnerabilityName":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","dateAdded":"2026-08-11","dueDate":"2026-08-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-68820","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-68820/"},{"cveID":"CVE-2026-50522","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ","dateAdded":"2026-07-22","dueDate":"2026-07-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-50522","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-50522/"},{"cveID":"CVE-2026-58644","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-07-16","dueDate":"2026-07-19","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58644","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-58644/"},{"cveID":"CVE-2026-56164","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-07-14","dueDate":"2026-07-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56164","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-56164/"},{"cveID":"CVE-2026-56155","vendorProject":"Microsoft","product":"Active Directory Federation Services","vulnerabilityName":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ","dateAdded":"2026-07-14","dueDate":"2026-07-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1220"],"shortDescription":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56155; https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-56155/"},{"cveID":"CVE-2026-45659","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-07-01","dueDate":"2026-07-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-45659","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-45659/"},{"cveID":"CVE-2026-45498","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender Denial of Service Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Defender contains an unspecified vulnerability that allows for denial of service.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 ; https://nvd.nist.gov/vuln/detail/CVE-2026-45498","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-45498"},{"cveID":"CVE-2026-41091","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender Link Following Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-59"],"shortDescription":"Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41091","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-41091"},{"cveID":"CVE-2010-0806","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-399"],"shortDescription":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2010-0806"},{"cveID":"CVE-2010-0249","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2010-0249"},{"cveID":"CVE-2009-1537","vendorProject":"Microsoft","product":"DirectX","vulnerabilityName":"Microsoft DirectX NULL Byte Overwrite Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2009-1537"},{"cveID":"CVE-2008-4250","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Buffer Overflow Vulnerability","dateAdded":"2026-05-20","dueDate":"2026-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2008-4250"},{"cveID":"CVE-2026-42897","vendorProject":"Microsoft","product":"Microsoft","vulnerabilityName":"Microsoft Exchange Server Cross-Site Scripting Vulnerability","dateAdded":"2026-05-15","dueDate":"2026-05-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897 ; https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service ; https://nvd.nist.gov/vuln/detail/CVE-2026-42897","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-42897"},{"cveID":"CVE-2026-32202","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Protection Mechanism Failure Vulnerability","dateAdded":"2026-04-28","dueDate":"2026-05-12","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-32202"},{"cveID":"CVE-2026-33825","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","dateAdded":"2026-04-22","dueDate":"2026-05-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-1220"],"shortDescription":"Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-33825"},{"cveID":"CVE-2026-32201","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Improper Input Validation Vulnerability","dateAdded":"2026-04-14","dueDate":"2026-04-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32201","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-32201"},{"cveID":"CVE-2009-0238","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Remote Code Execution","dateAdded":"2026-04-14","dueDate":"2026-04-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0238","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2009-0238"},{"cveID":"CVE-2025-60710","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Link Following Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"Microsoft Windows contains a link following vulnerability that allows for privilege escalation","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-60710"},{"cveID":"CVE-2023-36424","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Out-of-Bounds Read Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-125"],"shortDescription":"Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2023-36424"},{"cveID":"CVE-2023-21529","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2023-21529"},{"cveID":"CVE-2012-1854","vendorProject":"Microsoft","product":"Visual Basic for Applications (VBA)","vulnerabilityName":"Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-426"],"shortDescription":"Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2012-1854"},{"cveID":"CVE-2026-20963","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-03-18","dueDate":"2026-03-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963 ; https://nvd.nist.gov/vuln/detail/CVE-2026-20963","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-20963"},{"cveID":"CVE-2008-0015","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":" Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability","dateAdded":"2026-02-17","dueDate":"2026-03-10","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx ; https://nvd.nist.gov/vuln/detail/CVE-2008-0015","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2008-0015"},{"cveID":"CVE-2024-43468","vendorProject":"Microsoft","product":"Configuration Manager","vulnerabilityName":"Microsoft Configuration Manager SQL Injection Vulnerability","dateAdded":"2026-02-12","dueDate":"2026-03-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43468","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-43468"},{"cveID":"CVE-2026-21533","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Improper Privilege Management Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21533","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21533"},{"cveID":"CVE-2026-21525","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NULL Pointer Dereference Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-476"],"shortDescription":"Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21525"},{"cveID":"CVE-2026-21519","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Type Confusion Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21519","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21519"},{"cveID":"CVE-2026-21514","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-807"],"shortDescription":"Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21514","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21514"},{"cveID":"CVE-2026-21513","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21513"},{"cveID":"CVE-2026-21510","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Shell Protection Mechanism Failure Vulnerability","dateAdded":"2026-02-10","dueDate":"2026-03-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21510 ","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21510"},{"cveID":"CVE-2026-21509","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Security Feature Bypass Vulnerability","dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-807"],"shortDescription":"Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-21509"},{"cveID":"CVE-2026-20805","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Information Disclosure Vulnerability","dateAdded":"2026-01-13","dueDate":"2026-02-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805 ; https://nvd.nist.gov/vuln/detail/CVE-2026-20805","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-20805"},{"cveID":"CVE-2009-0556","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office PowerPoint Code Injection Vulnerability","dateAdded":"2026-01-07","dueDate":"2026-01-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0556","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2009-0556"},{"cveID":"CVE-2025-62221","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Use After Free Vulnerability","dateAdded":"2025-12-09","dueDate":"2025-12-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62221 ; https://nvd.nist.gov/vuln/detail/CVE-2025-62221","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-62221"},{"cveID":"CVE-2025-62215","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Race Condition Vulnerability","dateAdded":"2025-11-12","dueDate":"2025-12-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-362"],"shortDescription":"Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62215 ; https://nvd.nist.gov/vuln/detail/CVE-2025-62215","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-62215"},{"cveID":"CVE-2025-59287","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability","dateAdded":"2025-10-24","dueDate":"2025-11-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59287 ; https://nvd.nist.gov/vuln/detail/CVE-2025-59287","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-59287"},{"cveID":"CVE-2025-33073","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SMB Client Improper Access Control Vulnerability","dateAdded":"2025-10-20","dueDate":"2025-11-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33073","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-33073"},{"cveID":"CVE-2025-59230","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Improper Access Control Vulnerability","dateAdded":"2025-10-14","dueDate":"2025-11-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59230 ; https://nvd.nist.gov/vuln/detail/CVE-2025-59230","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-59230"},{"cveID":"CVE-2025-24990","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Untrusted Pointer Dereference Vulnerability","dateAdded":"2025-10-14","dueDate":"2025-11-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-822"],"shortDescription":"Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24990 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24990","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24990"},{"cveID":"CVE-2021-43226","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226 ; https://nvd.nist.gov/vuln/detail/CVE-2021-43226","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2021-43226"},{"cveID":"CVE-2013-3918","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Out-of-Bounds Write Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090 ; https://nvd.nist.gov/vuln/detail/CVE-2013-3918","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2013-3918"},{"cveID":"CVE-2011-3402","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Remote Code Execution Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 ; https://nvd.nist.gov/vuln/detail/CVE-2011-3402","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2011-3402"},{"cveID":"CVE-2010-3962","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2010-3962"},{"cveID":"CVE-2013-3893","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Resource Management Errors Vulnerability","dateAdded":"2025-08-12","dueDate":"2025-09-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-399"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 ; https://nvd.nist.gov/vuln/detail/CVE-2013-3893","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2013-3893"},{"cveID":"CVE-2007-0671","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Excel Remote Code Execution Vulnerability","dateAdded":"2025-08-12","dueDate":"2025-09-02","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015 ; https://nvd.nist.gov/vuln/detail/CVE-2007-0671","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2007-0671"},{"cveID":"CVE-2025-49706","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Improper Authentication Vulnerability","dateAdded":"2025-07-22","dueDate":"2025-07-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 ; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49706","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-49706"},{"cveID":"CVE-2025-49704","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Code Injection Vulnerability","dateAdded":"2025-07-22","dueDate":"2025-07-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49704","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-49704"},{"cveID":"CVE-2025-53770","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","dateAdded":"2025-07-20","dueDate":"2025-07-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53770","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-53770"},{"cveID":"CVE-2025-33053","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":" Microsoft Windows External Control of File Name or Path Vulnerability","dateAdded":"2025-06-10","dueDate":"2025-07-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-73"],"shortDescription":"Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33053","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-33053"},{"cveID":"CVE-2025-32709","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","dateAdded":"2025-05-13","dueDate":"2025-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32709 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32709","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-32709"},{"cveID":"CVE-2025-32706","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","dateAdded":"2025-05-13","dueDate":"2025-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32706 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32706","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-32706"},{"cveID":"CVE-2025-32701","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","dateAdded":"2025-05-13","dueDate":"2025-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32701 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32701","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-32701"},{"cveID":"CVE-2025-30400","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows DWM Core Library Use-After-Free Vulnerability","dateAdded":"2025-05-13","dueDate":"2025-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30400","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-30400"},{"cveID":"CVE-2025-30397","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Scripting Engine Type Confusion Vulnerability","dateAdded":"2025-05-13","dueDate":"2025-06-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30397","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-30397"},{"cveID":"CVE-2025-24054","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability","dateAdded":"2025-04-17","dueDate":"2025-05-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-73"],"shortDescription":"Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24054","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24054"},{"cveID":"CVE-2025-29824","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","dateAdded":"2025-04-08","dueDate":"2025-04-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29824","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-29824"},{"cveID":"CVE-2025-26633","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-707"],"shortDescription":"Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26633 ; https://nvd.nist.gov/vuln/detail/CVE-2025-26633","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-26633"},{"cveID":"CVE-2025-24993","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24993 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24993","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24993"},{"cveID":"CVE-2025-24991","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-125"],"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24991 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24991","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24991"},{"cveID":"CVE-2025-24985","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-190","CWE-122"],"shortDescription":"Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24985 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24985","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24985"},{"cveID":"CVE-2025-24984","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTFS Information Disclosure Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-532"],"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24984 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24984","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24984"},{"cveID":"CVE-2025-24983","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Win32k Use-After-Free Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24983","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24983"},{"cveID":"CVE-2018-8639","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability","dateAdded":"2025-03-03","dueDate":"2025-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 ; https://nvd.nist.gov/vuln/detail/CVE-2018-8639","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2018-8639"},{"cveID":"CVE-2024-49035","vendorProject":"Microsoft","product":"Partner Center","vulnerabilityName":"Microsoft Partner Center Improper Access Control Vulnerability","dateAdded":"2025-02-25","dueDate":"2025-03-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-269"],"shortDescription":"Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49035","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-49035"},{"cveID":"CVE-2025-24989","vendorProject":"Microsoft","product":"Power Pages","vulnerabilityName":"Microsoft Power Pages Improper Access Control Vulnerability","dateAdded":"2025-02-21","dueDate":"2025-03-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.","requiredAction":"Apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24989 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24989","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24989"},{"cveID":"CVE-2025-21418","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability","dateAdded":"2025-02-11","dueDate":"2025-03-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21418","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21418"},{"cveID":"CVE-2025-21391","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Storage Link Following Vulnerability","dateAdded":"2025-02-11","dueDate":"2025-03-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-59"],"shortDescription":"Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21391","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21391"},{"cveID":"CVE-2024-21413","vendorProject":"Microsoft","product":"Office Outlook","vulnerabilityName":"Microsoft Outlook Improper Input Validation Vulnerability","dateAdded":"2025-02-06","dueDate":"2025-02-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21413","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-21413"},{"cveID":"CVE-2024-29059","vendorProject":"Microsoft","product":".NET Framework","vulnerabilityName":"Microsoft .NET Framework Information Disclosure Vulnerability","dateAdded":"2025-02-04","dueDate":"2025-02-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-209"],"shortDescription":"Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059 ; https://nvd.nist.gov/vuln/detail/CVE-2024-29059","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-29059"},{"cveID":"CVE-2025-21335","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","dateAdded":"2025-01-14","dueDate":"2025-02-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21335 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21335","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21335"},{"cveID":"CVE-2025-21334","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability","dateAdded":"2025-01-14","dueDate":"2025-02-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21334 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21334","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21334"},{"cveID":"CVE-2025-21333","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability","dateAdded":"2025-01-14","dueDate":"2025-02-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-21333 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21333","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-21333"},{"cveID":"CVE-2024-35250","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability ","dateAdded":"2024-12-16","dueDate":"2025-01-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-822"],"shortDescription":"Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250 ; https://nvd.nist.gov/vuln/detail/CVE-2024-35250","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-35250"},{"cveID":"CVE-2024-49138","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability","dateAdded":"2024-12-10","dueDate":"2024-12-31","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49138","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-49138"},{"cveID":"CVE-2024-49039","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Task Scheduler Privilege Escalation Vulnerability","dateAdded":"2024-11-12","dueDate":"2024-12-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49039","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-49039"},{"cveID":"CVE-2024-43451","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability","dateAdded":"2024-11-12","dueDate":"2024-12-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-73"],"shortDescription":"Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43451","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-43451"},{"cveID":"CVE-2024-38094","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization Vulnerability","dateAdded":"2024-10-22","dueDate":"2024-11-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38094","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38094"},{"cveID":"CVE-2024-30088","vendorProject":"Microsoft","product":"Windows ","vulnerabilityName":"Microsoft Windows Kernel TOCTOU Race Condition Vulnerability","dateAdded":"2024-10-15","dueDate":"2024-11-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-367"],"shortDescription":"Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. ","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ; https://nvd.nist.gov/vuln/detail/CVE-2024-30088","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-30088"},{"cveID":"CVE-2024-43573","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","dateAdded":"2024-10-08","dueDate":"2024-10-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43573","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-43573"},{"cveID":"CVE-2024-43572","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Management Console Remote Code Execution Vulnerability","dateAdded":"2024-10-08","dueDate":"2024-10-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-707"],"shortDescription":"Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/advisory/CVE-2024-43572 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43572","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-43572"},{"cveID":"CVE-2020-0618","vendorProject":"Microsoft","product":"SQL Server","vulnerabilityName":"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability","dateAdded":"2024-09-18","dueDate":"2024-10-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618  ;  https://nvd.nist.gov/vuln/detail/CVE-2020-0618","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2020-0618"},{"cveID":"CVE-2024-43461","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","dateAdded":"2024-09-16","dueDate":"2024-10-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-451"],"shortDescription":"Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43461","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-43461"},{"cveID":"CVE-2024-38226","vendorProject":"Microsoft","product":"Publisher","vulnerabilityName":"Microsoft Publisher Protection Mechanism Failure Vulnerability","dateAdded":"2024-09-10","dueDate":"2024-10-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226; https://nvd.nist.gov/vuln/detail/CVE-2024-38226","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38226"},{"cveID":"CVE-2024-38217","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability","dateAdded":"2024-09-10","dueDate":"2024-10-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217; https://nvd.nist.gov/vuln/detail/CVE-2024-38217","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38217"},{"cveID":"CVE-2024-38014","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Installer Improper Privilege Management Vulnerability","dateAdded":"2024-09-10","dueDate":"2024-10-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014; https://nvd.nist.gov/vuln/detail/CVE-2024-38014","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38014"},{"cveID":"CVE-2021-31196","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Information Disclosure Vulnerability","dateAdded":"2024-08-21","dueDate":"2024-09-11","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-31196; https://nvd.nist.gov/vuln/detail/CVE-2021-31196","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2021-31196"},{"cveID":"CVE-2024-38213","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213; https://nvd.nist.gov/vuln/detail/CVE-2024-38213","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38213"},{"cveID":"CVE-2024-38193","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193; https://nvd.nist.gov/vuln/detail/CVE-2024-38193","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38193"},{"cveID":"CVE-2024-38189","vendorProject":"Microsoft","product":"Project","vulnerabilityName":"Microsoft Project Remote Code Execution Vulnerability ","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189; https://nvd.nist.gov/vuln/detail/CVE-2024-38189","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38189"},{"cveID":"CVE-2024-38178","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178; https://nvd.nist.gov/vuln/detail/CVE-2024-38178","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38178"},{"cveID":"CVE-2024-38107","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38107; https://nvd.nist.gov/vuln/detail/CVE-2024-38107","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38107"},{"cveID":"CVE-2024-38106","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2024-08-13","dueDate":"2024-09-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-591"],"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38106; https://nvd.nist.gov/vuln/detail/CVE-2024-38106","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38106"},{"cveID":"CVE-2018-0824","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability","dateAdded":"2024-08-05","dueDate":"2024-08-26","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0824; https://nvd.nist.gov/vuln/detail/CVE-2018-0824","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2018-0824"},{"cveID":"CVE-2012-4792","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2024-07-23","dueDate":"2024-08-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://learn.microsoft.com/en-us/lifecycle/products/internet-explorer-11; https://nvd.nist.gov/vuln/detail/CVE-2012-4792","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2012-4792"},{"cveID":"CVE-2024-38112","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Spoofing Vulnerability","dateAdded":"2024-07-09","dueDate":"2024-07-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-451"],"shortDescription":"Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112; https://nvd.nist.gov/vuln/detail/CVE-2024-38112","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38112"},{"cveID":"CVE-2024-38080","vendorProject":"Microsoft","product":"Windows ","vulnerabilityName":"Microsoft Windows Hyper-V Privilege Escalation Vulnerability","dateAdded":"2024-07-09","dueDate":"2024-07-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-190"],"shortDescription":"Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38080; https://nvd.nist.gov/vuln/detail/CVE-2024-38080","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38080"},{"cveID":"CVE-2024-26169","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability","dateAdded":"2024-06-13","dueDate":"2024-07-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26169; https://nvd.nist.gov/vuln/detail/CVE-2024-26169","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-26169"},{"cveID":"CVE-2024-30051","vendorProject":"Microsoft","product":"DWM Core Library","vulnerabilityName":" Microsoft DWM Core Library Privilege Escalation Vulnerability","dateAdded":"2024-05-14","dueDate":"2024-06-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051; https://nvd.nist.gov/vuln/detail/CVE-2024-30051","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-30051"},{"cveID":"CVE-2024-30040","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability","dateAdded":"2024-05-14","dueDate":"2024-06-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30040; https://nvd.nist.gov/vuln/detail/CVE-2024-30040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-30040"},{"cveID":"CVE-2024-29988","vendorProject":"Microsoft","product":"SmartScreen Prompt","vulnerabilityName":"Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability","dateAdded":"2024-04-30","dueDate":"2024-05-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-693"],"shortDescription":"Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988; https://nvd.nist.gov/vuln/detail/CVE-2024-29988","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-29988"},{"cveID":"CVE-2022-38028","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability ","dateAdded":"2024-04-23","dueDate":"2024-05-14","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.  ","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028;  https://nvd.nist.gov/vuln/detail/CVE-2022-38028","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2022-38028"},{"cveID":"CVE-2023-24955","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Code Injection Vulnerability","dateAdded":"2024-03-26","dueDate":"2024-04-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955;  https://nvd.nist.gov/vuln/detail/CVE-2023-24955","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-24955"},{"cveID":"CVE-2024-21338","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability","dateAdded":"2024-03-04","dueDate":"2024-03-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-822"],"shortDescription":"Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338; https://nvd.nist.gov/vuln/detail/CVE-2024-21338","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21338"},{"cveID":"CVE-2023-29360","vendorProject":"Microsoft","product":"Streaming Service","vulnerabilityName":"Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability","dateAdded":"2024-02-29","dueDate":"2024-03-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-822"],"shortDescription":"Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29360 ;https://nvd.nist.gov/vuln/detail/CVE-2023-29360","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-29360"},{"cveID":"CVE-2024-21410","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2024-02-15","dueDate":"2024-03-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410; https://nvd.nist.gov/vuln/detail/CVE-2024-21410","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21410"},{"cveID":"CVE-2024-21412","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability","dateAdded":"2024-02-13","dueDate":"2024-03-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-693"],"shortDescription":"Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412; https://nvd.nist.gov/vuln/detail/CVE-2024-21412","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21412"},{"cveID":"CVE-2024-21351","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2024-02-13","dueDate":"2024-03-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21351; https://nvd.nist.gov/vuln/detail/CVE-2024-21351","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21351"},{"cveID":"CVE-2023-29357","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Privilege Escalation Vulnerability","dateAdded":"2024-01-10","dueDate":"2024-01-31","knownRansomwareCampaignUse":"Known","cwes":["CWE-303"],"shortDescription":"Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357; https://nvd.nist.gov/vuln/detail/CVE-2023-29357","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-29357"},{"cveID":"CVE-2023-36584","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","dateAdded":"2023-11-16","dueDate":"2023-12-07","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36584","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36584"},{"cveID":"CVE-2023-36036","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability","dateAdded":"2023-11-14","dueDate":"2023-12-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36036","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36036"},{"cveID":"CVE-2023-36033","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","dateAdded":"2023-11-14","dueDate":"2023-12-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-822"],"shortDescription":"Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36033","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36033"},{"cveID":"CVE-2023-36025","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2023-11-14","dueDate":"2023-12-05","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025;  https://nvd.nist.gov/vuln/detail/CVE-2023-36025","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36025"},{"cveID":"CVE-2023-41763","vendorProject":"Microsoft","product":"Skype for Business","vulnerabilityName":"Microsoft Skype for Business Privilege Escalation Vulnerability","dateAdded":"2023-10-10","dueDate":"2023-10-31","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-918"],"shortDescription":"Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763;   https://nvd.nist.gov/vuln/detail/CVE-2023-41763","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-41763"},{"cveID":"CVE-2023-36563","vendorProject":"Microsoft","product":"WordPad","vulnerabilityName":"Microsoft WordPad Information Disclosure Vulnerability","dateAdded":"2023-10-10","dueDate":"2023-10-31","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36563;  https://nvd.nist.gov/vuln/detail/CVE-2023-36563","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36563"},{"cveID":"CVE-2023-28229","vendorProject":"Microsoft","product":"Windows CNG Key Isolation Service","vulnerabilityName":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability","dateAdded":"2023-10-04","dueDate":"2023-10-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-591"],"shortDescription":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229; https://nvd.nist.gov/vuln/detail/CVE-2023-28229","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-28229"},{"cveID":"CVE-2023-36802","vendorProject":"Microsoft","product":"Streaming Service Proxy","vulnerabilityName":"Microsoft Streaming Service Proxy Privilege Escalation Vulnerability","dateAdded":"2023-09-12","dueDate":"2023-10-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802;   https://nvd.nist.gov/vuln/detail/CVE-2023-36802","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36802"},{"cveID":"CVE-2023-36761","vendorProject":"Microsoft","product":"Word","vulnerabilityName":"Microsoft Word Information Disclosure Vulnerability","dateAdded":"2023-09-12","dueDate":"2023-10-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-668"],"shortDescription":"Microsoft Word contains an unspecified vulnerability that allows for information disclosure.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761;  https://nvd.nist.gov/vuln/detail/CVE-2023-36761","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36761"},{"cveID":"CVE-2023-38180","vendorProject":"Microsoft","product":".NET Core and Visual Studio","vulnerabilityName":"Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability","dateAdded":"2023-08-09","dueDate":"2023-08-30","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180;  https://nvd.nist.gov/vuln/detail/CVE-2023-38180","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-38180"},{"cveID":"CVE-2023-36884","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Search Remote Code Execution Vulnerability","dateAdded":"2023-07-17","dueDate":"2023-08-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-362"],"shortDescription":"Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884;  https://nvd.nist.gov/vuln/detail/CVE-2023-36884","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36884"},{"cveID":"CVE-2023-36874","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability","dateAdded":"2023-07-11","dueDate":"2023-08-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-59"],"shortDescription":"Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874;  https://nvd.nist.gov/vuln/detail/CVE-2023-36874","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36874"},{"cveID":"CVE-2023-35311","vendorProject":"Microsoft","product":"Outlook","vulnerabilityName":"Microsoft Outlook Security Feature Bypass Vulnerability","dateAdded":"2023-07-11","dueDate":"2023-08-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-367"],"shortDescription":"Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311;  https://nvd.nist.gov/vuln/detail/CVE-2023-35311","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-35311"},{"cveID":"CVE-2023-32049","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2023-07-11","dueDate":"2023-08-01","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049; https://nvd.nist.gov/vuln/detail/CVE-2023-32049","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-32049"},{"cveID":"CVE-2023-32046","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability","dateAdded":"2023-07-11","dueDate":"2023-08-01","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046;  https://nvd.nist.gov/vuln/detail/CVE-2023-32046","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-32046"},{"cveID":"CVE-2016-0165","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2023-06-22","dueDate":"2023-07-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039; https://nvd.nist.gov/vuln/detail/CVE-2016-0165","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2016-0165"},{"cveID":"CVE-2023-29336","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32K Privilege Escalation Vulnerability","dateAdded":"2023-05-09","dueDate":"2023-05-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29336; https://nvd.nist.gov/vuln/detail/CVE-2023-29336","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-29336"},{"cveID":"CVE-2023-28252","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2023-04-11","dueDate":"2023-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252;  https://nvd.nist.gov/vuln/detail/CVE-2023-28252","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-28252"},{"cveID":"CVE-2019-1388","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability","dateAdded":"2023-04-07","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388; https://nvd.nist.gov/vuln/detail/CVE-2019-1388","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2019-1388"},{"cveID":"CVE-2013-3163","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2023-03-30","dueDate":"2023-04-20","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://nvd.nist.gov/vuln/detail/CVE-2013-3163","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2013-3163"},{"cveID":"CVE-2023-24880","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2023-03-14","dueDate":"2023-04-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-24880;  https://nvd.nist.gov/vuln/detail/CVE-2023-24880","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-24880"},{"cveID":"CVE-2023-23397","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Outlook Privilege Escalation Vulnerability","dateAdded":"2023-03-14","dueDate":"2023-04-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-294"],"shortDescription":"Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ;  https://nvd.nist.gov/vuln/detail/CVE-2023-23397","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-23397"},{"cveID":"CVE-2023-23376","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2023-02-14","dueDate":"2023-03-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376;  https://nvd.nist.gov/vuln/detail/CVE-2023-23376","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-23376"},{"cveID":"CVE-2023-21823","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Graphic Component Privilege Escalation Vulnerability","dateAdded":"2023-02-14","dueDate":"2023-03-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-190"],"shortDescription":"Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823;  https://nvd.nist.gov/vuln/detail/CVE-2023-21823","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-21823"},{"cveID":"CVE-2023-21715","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Publisher Security Feature Bypass Vulnerability","dateAdded":"2023-02-14","dueDate":"2023-03-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21715;  https://nvd.nist.gov/vuln/detail/CVE-2023-21715","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-21715"},{"cveID":"CVE-2023-21674","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability","dateAdded":"2023-01-10","dueDate":"2023-01-31","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674;  https://nvd.nist.gov/vuln/detail/CVE-2023-21674","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-21674"},{"cveID":"CVE-2022-41080","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2023-01-10","dueDate":"2023-01-31","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080;  https://nvd.nist.gov/vuln/detail/CVE-2022-41080","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-41080"},{"cveID":"CVE-2022-44698","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2022-12-13","dueDate":"2023-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-755"],"shortDescription":"Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698;  https://nvd.nist.gov/vuln/detail/CVE-2022-44698","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-44698"},{"cveID":"CVE-2022-41049","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","dateAdded":"2022-11-14","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-274"],"shortDescription":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41049;  https://nvd.nist.gov/vuln/detail/CVE-2022-41049","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41049"},{"cveID":"CVE-2022-41128","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Scripting Languages Remote Code Execution Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128;  https://nvd.nist.gov/vuln/detail/CVE-2022-41128","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41128"},{"cveID":"CVE-2022-41125","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41125;  https://nvd.nist.gov/vuln/detail/CVE-2022-41125","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41125"},{"cveID":"CVE-2022-41091","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091;  https://nvd.nist.gov/vuln/detail/CVE-2022-41091","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41091"},{"cveID":"CVE-2022-41073","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073;  https://nvd.nist.gov/vuln/detail/CVE-2022-41073","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41073"},{"cveID":"CVE-2022-41033","vendorProject":"Microsoft","product":"Windows COM+ Event System Service","vulnerabilityName":"Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability","dateAdded":"2022-10-11","dueDate":"2022-11-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033;  https://nvd.nist.gov/vuln/detail/CVE-2022-41033","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41033"},{"cveID":"CVE-2022-41082","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2022-09-30","dueDate":"2022-10-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41082","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41082"},{"cveID":"CVE-2022-41040","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","dateAdded":"2022-09-30","dueDate":"2022-10-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41040"},{"cveID":"CVE-2010-2568","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Remote Code Execution Vulnerability","dateAdded":"2022-09-15","dueDate":"2022-10-06","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-2568"},{"cveID":"CVE-2022-37969","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2022-09-14","dueDate":"2022-10-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-787"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969;  https://nvd.nist.gov/vuln/detail/CVE-2022-37969","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-37969"},{"cveID":"CVE-2022-26923","vendorProject":"Microsoft","product":"Active Directory","vulnerabilityName":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","dateAdded":"2022-08-18","dueDate":"2022-09-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-295"],"shortDescription":"An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26923;  https://nvd.nist.gov/vuln/detail/CVE-2022-26923","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26923"},{"cveID":"CVE-2022-21971","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Runtime Remote Code Execution Vulnerability","dateAdded":"2022-08-18","dueDate":"2022-09-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-824"],"shortDescription":"Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21971;  https://nvd.nist.gov/vuln/detail/CVE-2022-21971","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21971"},{"cveID":"CVE-2022-34713","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","dateAdded":"2022-08-09","dueDate":"2022-08-30","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713;  https://nvd.nist.gov/vuln/detail/CVE-2022-34713","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-34713"},{"cveID":"CVE-2022-22047","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability","dateAdded":"2022-07-12","dueDate":"2022-08-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-426"],"shortDescription":"Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047;  https://nvd.nist.gov/vuln/detail/CVE-2022-22047","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-22047"},{"cveID":"CVE-2022-26925","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows LSA Spoofing Vulnerability","dateAdded":"2022-07-01","dueDate":"2022-07-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.","requiredAction":"Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].","notes":"WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.;  https://nvd.nist.gov/vuln/detail/CVE-2022-26925","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26925"},{"cveID":"CVE-2022-30190","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","dateAdded":"2022-06-14","dueDate":"2022-07-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-610"],"shortDescription":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-30190","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-30190"},{"cveID":"CVE-2013-1331","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Buffer Overflow Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-1331","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-1331"},{"cveID":"CVE-2012-4969","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-4969","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-4969"},{"cveID":"CVE-2012-1889","vendorProject":"Microsoft","product":"XML Core Services","vulnerabilityName":"Microsoft XML Core Services Memory Corruption Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-1889","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-1889"},{"cveID":"CVE-2012-0151","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0151","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-0151"},{"cveID":"CVE-2010-2572","vendorProject":"Microsoft","product":"PowerPoint","vulnerabilityName":"Microsoft PowerPoint Buffer Overflow Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-2572","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-2572"},{"cveID":"CVE-2009-0563","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Buffer Overflow Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-0563","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2009-0563"},{"cveID":"CVE-2009-0557","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Object Record Corruption Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-0557","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2009-0557"},{"cveID":"CVE-2006-2492","vendorProject":"Microsoft","product":"Word","vulnerabilityName":"Microsoft Word Malformed Object Pointer Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2006-2492","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2006-2492"},{"cveID":"CVE-2016-7256","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Open Type Font Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7256","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-7256"},{"cveID":"CVE-2016-3393","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3393","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3393"},{"cveID":"CVE-2016-0034","vendorProject":"Microsoft","product":"Silverlight","vulnerabilityName":"Microsoft Silverlight Runtime Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).","requiredAction":"The impacted products are end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0034","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0034"},{"cveID":"CVE-2015-6175","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-6175","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-6175"},{"cveID":"CVE-2015-2425","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2425","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2425"},{"cveID":"CVE-2015-2360","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2360","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2360"},{"cveID":"CVE-2015-1769","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mount Manager Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1769","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1769"},{"cveID":"CVE-2015-1671","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-19"],"shortDescription":"A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1671","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1671"},{"cveID":"CVE-2015-0071","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer ASLR Bypass Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-0071","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-0071"},{"cveID":"CVE-2015-0016","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows TS WebProxy Directory Traversal Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-0016","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-0016"},{"cveID":"CVE-2014-4148","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-4148","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-4148"},{"cveID":"CVE-2014-4123","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-4123","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-4123"},{"cveID":"CVE-2014-4077","vendorProject":"Microsoft","product":"Input Method Editor (IME) Japanese","vulnerabilityName":"Microsoft IME Japanese Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-4077","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-4077"},{"cveID":"CVE-2014-2817","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Privilege Escalation Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-2817","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-2817"},{"cveID":"CVE-2013-7331","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Information Disclosure Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-7331","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-7331"},{"cveID":"CVE-2013-3896","vendorProject":"Microsoft","product":"Silverlight","vulnerabilityName":"Microsoft Silverlight Information Disclosure Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3896","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3896"},{"cveID":"CVE-2013-0074","vendorProject":"Microsoft","product":"Silverlight","vulnerabilityName":"Microsoft Silverlight Double Dereference Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0074","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-0074"},{"cveID":"CVE-2018-8611","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-404"],"shortDescription":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8611","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8611"},{"cveID":"CVE-2017-8543","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Search Remote Code Execution Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-281"],"shortDescription":"Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8543","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-8543"},{"cveID":"CVE-2017-0210","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Privilege Escalation Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0210","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0210"},{"cveID":"CVE-2017-0149","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0149","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0149"},{"cveID":"CVE-2017-0147","vendorProject":"Microsoft","product":"SMBv1 server","vulnerabilityName":"Microsoft Windows SMBv1 Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0147","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0147"},{"cveID":"CVE-2017-0022","vendorProject":"Microsoft","product":"XML Core Services","vulnerabilityName":"Microsoft XML Core Services Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0022","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0022"},{"cveID":"CVE-2017-0005","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0005","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0005"},{"cveID":"CVE-2016-3351","vendorProject":"Microsoft","product":"Internet Explorer and Edge","vulnerabilityName":"Microsoft Internet Explorer and Edge Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3351","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3351"},{"cveID":"CVE-2016-3298","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3298","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3298"},{"cveID":"CVE-2016-0162","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0162","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0162"},{"cveID":"CVE-2020-1027","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1027","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-1027"},{"cveID":"CVE-2020-0638","vendorProject":"Microsoft","product":"Update Notification Manager","vulnerabilityName":"Microsoft Update Notification Manager Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0638","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0638"},{"cveID":"CVE-2019-1385","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1385","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1385"},{"cveID":"CVE-2019-1130","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1130","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1130"},{"cveID":"CVE-2019-0880","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0880","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0880"},{"cveID":"CVE-2019-0703","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SMB Information Disclosure Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0703","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0703"},{"cveID":"CVE-2019-0676","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Information Disclosure Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0676","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0676"},{"cveID":"CVE-2018-8589","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8589","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8589"},{"cveID":"CVE-2014-4113","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-05-04","dueDate":"2022-05-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-4113","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-4113"},{"cveID":"CVE-2014-0322","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2022-05-04","dueDate":"2022-05-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-0322","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-0322"},{"cveID":"CVE-2022-26904","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-362"],"shortDescription":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26904","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26904"},{"cveID":"CVE-2022-21919","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1386"],"shortDescription":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-21919","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21919"},{"cveID":"CVE-2021-41357","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41357","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-41357"},{"cveID":"CVE-2021-40450","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40450","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-40450"},{"cveID":"CVE-2022-22718","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","dateAdded":"2022-04-19","dueDate":"2022-05-10","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-22718","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-22718"},{"cveID":"CVE-2022-24521","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows CLFS Driver Privilege Escalation Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-787","CWE-1285"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-24521","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-24521"},{"cveID":"CVE-2015-2502","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2502","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2502"},{"cveID":"CVE-2021-42287","vendorProject":"Microsoft","product":"Active Directory","vulnerabilityName":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","dateAdded":"2022-04-11","dueDate":"2022-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42287","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-42287"},{"cveID":"CVE-2021-42278","vendorProject":"Microsoft","product":"Active Directory","vulnerabilityName":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","dateAdded":"2022-04-11","dueDate":"2022-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42278","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-42278"},{"cveID":"CVE-2021-31166","vendorProject":"Microsoft","product":"HTTP Protocol Stack","vulnerabilityName":"Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability","dateAdded":"2022-04-06","dueDate":"2022-04-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31166","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-31166"},{"cveID":"CVE-2017-0148","vendorProject":"Microsoft","product":"SMBv1 server","vulnerabilityName":"Microsoft SMBv1 Server Remote Code Execution Vulnerability","dateAdded":"2022-04-06","dueDate":"2022-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0148","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0148"},{"cveID":"CVE-2021-34484","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows User Profile Service Privilege Escalation Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-269"],"shortDescription":"Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34484","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-34484"},{"cveID":"CVE-2021-38646","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38646","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-38646"},{"cveID":"CVE-2021-34486","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Event Tracing Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34486","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-34486"},{"cveID":"CVE-2018-8440","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8440","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8440"},{"cveID":"CVE-2018-8406","vendorProject":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","vulnerabilityName":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8406","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8406"},{"cveID":"CVE-2018-8405","vendorProject":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","vulnerabilityName":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8405","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8405"},{"cveID":"CVE-2017-0213","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0213","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0213"},{"cveID":"CVE-2017-0059","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Information Disclosure Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0059","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0059"},{"cveID":"CVE-2017-0037","vendorProject":"Microsoft","product":"Edge and Internet Explorer","vulnerabilityName":"Microsoft Edge and Internet Explorer Type Confusion Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-704"],"shortDescription":"Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0037","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0037"},{"cveID":"CVE-2016-7201","vendorProject":"Microsoft","product":"Edge","vulnerabilityName":"Microsoft Edge Memory Corruption Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7201","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-7201"},{"cveID":"CVE-2016-7200","vendorProject":"Microsoft","product":"Edge","vulnerabilityName":"Microsoft Edge Memory Corruption Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7200","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-7200"},{"cveID":"CVE-2016-0189","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0189","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0189"},{"cveID":"CVE-2016-0151","vendorProject":"Microsoft","product":"Client-Server Run-time Subsystem (CSRSS)","vulnerabilityName":"Microsoft Windows CSRSS Security Feature Bypass Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0151","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0151"},{"cveID":"CVE-2016-0040","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0040"},{"cveID":"CVE-2015-2426","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2426","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2426"},{"cveID":"CVE-2015-2419","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2419","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2419"},{"cveID":"CVE-2015-1770","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Uninitialized Memory Use Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-19"],"shortDescription":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1770","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1770"},{"cveID":"CVE-2013-3660","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3660","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3660"},{"cveID":"CVE-2013-2551","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-2551","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-2551"},{"cveID":"CVE-2012-2539","vendorProject":"Microsoft","product":"Word","vulnerabilityName":"Microsoft Word Remote Code Execution Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-399"],"shortDescription":"Microsoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-2539","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-2539"},{"cveID":"CVE-2011-2005","vendorProject":"Microsoft","product":"Ancillary Function Driver (afd.sys)","vulnerabilityName":"Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2011-2005","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2011-2005"},{"cveID":"CVE-2010-4398","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-4398","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-4398"},{"cveID":"CVE-2022-21999","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-40","CWE-1386"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-21999","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21999"},{"cveID":"CVE-2019-0903","vendorProject":"Microsoft","product":"Graphics Device Interface (GDI)","vulnerabilityName":"Microsoft GDI Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0903","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0903"},{"cveID":"CVE-2018-8414","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Shell Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8414","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8414"},{"cveID":"CVE-2018-8373","vendorProject":"Microsoft","product":"Internet Explorer Scripting Engine","vulnerabilityName":"Microsoft Scripting Engine Memory Corruption Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8373","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8373"},{"cveID":"CVE-2017-0146","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SMB Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0146","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0146"},{"cveID":"CVE-2014-6332","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-6332","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-6332"},{"cveID":"CVE-2014-6324","vendorProject":"Microsoft","product":"Kerberos Key Distribution Center (KDC)","vulnerabilityName":"Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-6324","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-6324"},{"cveID":"CVE-2019-1405","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1405","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1405"},{"cveID":"CVE-2019-1322","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1322","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1322"},{"cveID":"CVE-2019-1315","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1315","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1315"},{"cveID":"CVE-2019-1253","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1253","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1253"},{"cveID":"CVE-2019-1132","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1132","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1132"},{"cveID":"CVE-2019-1129","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1129","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1129"},{"cveID":"CVE-2019-1069","vendorProject":"Microsoft","product":"Task Scheduler","vulnerabilityName":"Microsoft Task Scheduler Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1069","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1069"},{"cveID":"CVE-2019-1064","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1064","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1064"},{"cveID":"CVE-2019-0841","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0841","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0841"},{"cveID":"CVE-2019-0543","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0543","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0543"},{"cveID":"CVE-2018-8120","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8120","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8120"},{"cveID":"CVE-2017-0101","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Transaction Manager Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0101","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0101"},{"cveID":"CVE-2016-3309","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3309","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3309"},{"cveID":"CVE-2015-2546","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Memory Corruption Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2546","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2546"},{"cveID":"CVE-2021-41379","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-1386"],"shortDescription":"Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41379","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-41379"},{"cveID":"CVE-2019-1297","vendorProject":"Microsoft","product":"Excel","vulnerabilityName":"Microsoft Excel Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1297","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1297"},{"cveID":"CVE-2018-8581","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8581","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8581"},{"cveID":"CVE-2017-8540","vendorProject":"Microsoft","product":"Malware Protection Engine","vulnerabilityName":"Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability\".","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8540","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-8540"},{"cveID":"CVE-2017-11826","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11826","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-11826"},{"cveID":"CVE-2017-0261","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Use-After-Free Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0261","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0261"},{"cveID":"CVE-2017-0001","vendorProject":"Microsoft","product":"Graphics Device Interface (GDI)","vulnerabilityName":"Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0001","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0001"},{"cveID":"CVE-2016-7262","vendorProject":"Microsoft","product":"Excel","vulnerabilityName":"Microsoft Office Security Feature Bypass Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7262","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-7262"},{"cveID":"CVE-2016-7193","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7193","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-7193"},{"cveID":"CVE-2016-0099","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0099","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0099"},{"cveID":"CVE-2015-2545","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Malformed EPS File Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2545","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2545"},{"cveID":"CVE-2015-2424","vendorProject":"Microsoft","product":"PowerPoint","vulnerabilityName":"Microsoft PowerPoint Memory Corruption Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2424","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2424"},{"cveID":"CVE-2015-2387","vendorProject":"Microsoft","product":"ATM Font Driver","vulnerabilityName":"Microsoft ATM Font Driver Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2387","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2387"},{"cveID":"CVE-2015-1701","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1701","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1701"},{"cveID":"CVE-2015-1642","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1642","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1642"},{"cveID":"CVE-2014-4114","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-4114","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-4114"},{"cveID":"CVE-2013-5065","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-5065","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-5065"},{"cveID":"CVE-2013-3897","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-399"],"shortDescription":"A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3897","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3897"},{"cveID":"CVE-2013-1347","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-1347","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-1347"},{"cveID":"CVE-2012-1856","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-1856","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-1856"},{"cveID":"CVE-2011-1889","vendorProject":"Microsoft","product":"Forefront Threat Management Gateway (TMG)","vulnerabilityName":"Microsoft Forefront TMG Remote Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2011-1889","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2011-1889"},{"cveID":"CVE-2010-3333","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Stack-based Buffer Overflow Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-3333","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-3333"},{"cveID":"CVE-2010-0232","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Exception Handler Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-0232","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-0232"},{"cveID":"CVE-2009-3129","vendorProject":"Microsoft","product":"Excel","vulnerabilityName":"Microsoft Excel Featheader Record Memory Corruption Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-3129","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2009-3129"},{"cveID":"CVE-2009-1123","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Improper Input Validation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-1123","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2009-1123"},{"cveID":"CVE-2004-0210","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2004-0210","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2004-0210"},{"cveID":"CVE-2002-0367","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2002-0367","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2002-0367"},{"cveID":"CVE-2017-8570","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Remote Code Execution Vulnerability","dateAdded":"2022-02-25","dueDate":"2022-08-25","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8570","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-8570"},{"cveID":"CVE-2017-0222","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Remote Code Execution Vulnerability","dateAdded":"2022-02-25","dueDate":"2022-08-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0222","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0222"},{"cveID":"CVE-2014-6352","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Code Injection Vulnerability","dateAdded":"2022-02-25","dueDate":"2022-08-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-6352","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-6352"},{"cveID":"CVE-2019-0752","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Type Confusion Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-843"],"shortDescription":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0752","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0752"},{"cveID":"CVE-2018-8174","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8174","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8174"},{"cveID":"CVE-2014-1761","vendorProject":"Microsoft","product":"Word","vulnerabilityName":"Microsoft Word Memory Corruption Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1761","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-1761"},{"cveID":"CVE-2013-3906","vendorProject":"Microsoft","product":"Graphics Component","vulnerabilityName":"Microsoft Graphics Component Memory Corruption Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3906","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3906"},{"cveID":"CVE-2021-36934","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SAM Local Privilege Escalation Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-02-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1220"],"shortDescription":"If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36934","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-36934"},{"cveID":"CVE-2020-0796","vendorProject":"Microsoft","product":"SMBv3","vulnerabilityName":"Microsoft SMBv3 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0796","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0796"},{"cveID":"CVE-2017-8464","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8464","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-8464"},{"cveID":"CVE-2017-0263","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0263","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0263"},{"cveID":"CVE-2017-0262","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"A remote code execution vulnerability exists in Microsoft Office.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0262","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0262"},{"cveID":"CVE-2017-0145","vendorProject":"Microsoft","product":"SMBv1","vulnerabilityName":"Microsoft SMBv1 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0145","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0145"},{"cveID":"CVE-2017-0144","vendorProject":"Microsoft","product":"SMBv1","vulnerabilityName":"Microsoft SMBv1 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0144"},{"cveID":"CVE-2015-1635","vendorProject":"Microsoft","product":"HTTP.sys","vulnerabilityName":"Microsoft HTTP.sys Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1635","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1635"},{"cveID":"CVE-2022-21882","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-02-04","dueDate":"2022-02-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-21882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21882"},{"cveID":"CVE-2020-0787","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-07-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-269","CWE-59"],"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0787"},{"cveID":"CVE-2014-1776","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-07-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-021?redirectedfrom=MSDN; https://nvd.nist.gov/vuln/detail/CVE-2014-1776","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-1776"},{"cveID":"CVE-2018-8453","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-01-21","dueDate":"2022-07-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8453","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8453"},{"cveID":"CVE-2021-33766","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Information Disclosure","dateAdded":"2022-01-18","dueDate":"2022-02-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33766","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-33766"},{"cveID":"CVE-2019-1458","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1458","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1458"},{"cveID":"CVE-2013-3900","vendorProject":"Microsoft","product":"WinVerifyTrust function","vulnerabilityName":"Microsoft WinVerifyTrust function Remote Code Execution","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3900","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3900"},{"cveID":"CVE-2021-43890","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","dateAdded":"2021-12-15","dueDate":"2021-12-29","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-43890"},{"cveID":"CVE-2021-42321","vendorProject":"Microsoft","product":"Exchange","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-17","dueDate":"2021-12-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-184","CWE-502"],"shortDescription":"An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42321","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42321"},{"cveID":"CVE-2021-42292","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Excel Security Feature Bypass","dateAdded":"2021-11-17","dueDate":"2021-12-01","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-357"],"shortDescription":"A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42292","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42292"},{"cveID":"CVE-2021-40449","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-17","dueDate":"2021-12-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40449"},{"cveID":"CVE-2021-40444","vendorProject":"Microsoft","product":"MSHTML","vulnerabilityName":"Microsoft MSHTML Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40444","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40444"},{"cveID":"CVE-2021-38649","vendorProject":"Microsoft","product":"Open Management Infrastructure (OMI)","vulnerabilityName":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38649","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-38649"},{"cveID":"CVE-2021-38648","vendorProject":"Microsoft","product":"Open Management Infrastructure (OMI)","vulnerabilityName":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1390"],"shortDescription":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38648","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-38648"},{"cveID":"CVE-2021-38647","vendorProject":"Microsoft","product":"Open Management Infrastructure (OMI)","vulnerabilityName":"Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-1390"],"shortDescription":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38647","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-38647"},{"cveID":"CVE-2021-38645","vendorProject":"Microsoft","product":"Open Management Infrastructure (OMI)","vulnerabilityName":"Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38645","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-38645"},{"cveID":"CVE-2021-36955","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36955"},{"cveID":"CVE-2021-36948","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Update Medic Service Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36948","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36948"},{"cveID":"CVE-2021-36942","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-749"],"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36942"},{"cveID":"CVE-2021-34527","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34527"},{"cveID":"CVE-2021-34523","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34523","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34523"},{"cveID":"CVE-2021-34473","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34473","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34473"},{"cveID":"CVE-2021-34448","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34448","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34448"},{"cveID":"CVE-2021-33771","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33771","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-33771"},{"cveID":"CVE-2021-33742","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787","CWE-823"],"shortDescription":"Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33742","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-33742"},{"cveID":"CVE-2021-33739","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-33739","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-33739"},{"cveID":"CVE-2021-31979","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31979","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31979"},{"cveID":"CVE-2021-31956","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows NTFS Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-191","CWE-787"],"shortDescription":"Microsoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31956","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31956"},{"cveID":"CVE-2021-31955","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Information Disclosure Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-497"],"shortDescription":"Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31955","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31955"},{"cveID":"CVE-2021-31207","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Security Feature Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-434"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31207","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31207"},{"cveID":"CVE-2021-31201","vendorProject":"Microsoft","product":"Enhanced Cryptographic Provider","vulnerabilityName":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31201","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31201"},{"cveID":"CVE-2021-31199","vendorProject":"Microsoft","product":"Enhanced Cryptographic Provider","vulnerabilityName":"Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31199","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31199"},{"cveID":"CVE-2021-28310","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-28310","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-28310"},{"cveID":"CVE-2021-27085","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27085","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27085"},{"cveID":"CVE-2021-27065","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-39"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-27065","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27065"},{"cveID":"CVE-2021-27059","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Office contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27059","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27059"},{"cveID":"CVE-2021-26858","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26858","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26858"},{"cveID":"CVE-2021-26857","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26857","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26857"},{"cveID":"CVE-2021-26855","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26855","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26855"},{"cveID":"CVE-2021-26411","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-26411","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26411"},{"cveID":"CVE-2021-1732","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1732","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1732"},{"cveID":"CVE-2021-1675","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-285"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1675"},{"cveID":"CVE-2021-1647","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122","CWE-1285"],"shortDescription":"Microsoft Defender contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1647","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1647"},{"cveID":"CVE-2020-17144","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17144","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-17144"},{"cveID":"CVE-2020-17087","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-131"],"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17087","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-17087"},{"cveID":"CVE-2020-1472","vendorProject":"Microsoft","product":"Netlogon","vulnerabilityName":"Microsoft Netlogon Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-330"],"shortDescription":"Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-04 (https://www.cisa.gov/news-events/directives/ed-20-04-mitigate-netlogon-elevation-privilege-vulnerability-august-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-04. https://nvd.nist.gov/vuln/detail/CVE-2020-1472","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1472"},{"cveID":"CVE-2020-1464","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Spoofing Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-347"],"shortDescription":"Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1464","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1464"},{"cveID":"CVE-2020-1380","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1380","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1380"},{"cveID":"CVE-2020-1350","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1350"},{"cveID":"CVE-2020-1147","vendorProject":"Microsoft","product":".NET Framework, SharePoint, Visual Studio","vulnerabilityName":"Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1147","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1147"},{"cveID":"CVE-2020-1054","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1054","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1054"},{"cveID":"CVE-2020-1040","vendorProject":"Microsoft","product":"Hyper-V RemoteFX","vulnerabilityName":"Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1040"},{"cveID":"CVE-2020-1020","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1020","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1020"},{"cveID":"CVE-2020-0986","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0986","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0986"},{"cveID":"CVE-2020-0968","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0968","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0968"},{"cveID":"CVE-2020-0938","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0938","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0938"},{"cveID":"CVE-2020-0878","vendorProject":"Microsoft","product":"Edge and Internet Explorer","vulnerabilityName":"Microsoft Edge and Internet Explorer Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0878","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0878"},{"cveID":"CVE-2020-0688","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0688","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0688"},{"cveID":"CVE-2020-0683","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0683","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0683"},{"cveID":"CVE-2020-0674","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0674","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0674"},{"cveID":"CVE-2020-0646","vendorProject":"Microsoft","product":".NET Framework","vulnerabilityName":"Microsoft .NET Framework Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-91"],"shortDescription":"Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0646","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0646"},{"cveID":"CVE-2020-0601","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows CryptoAPI Spoofing Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-295"],"shortDescription":"Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0601"},{"cveID":"CVE-2019-1429","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416","CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1429","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1429"},{"cveID":"CVE-2019-1367","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1367","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1367"},{"cveID":"CVE-2019-1215","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1215"},{"cveID":"CVE-2019-1214","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1214","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1214"},{"cveID":"CVE-2019-0863","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0863","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0863"},{"cveID":"CVE-2019-0859","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0859","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0859"},{"cveID":"CVE-2019-0808","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0808","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0808"},{"cveID":"CVE-2019-0803","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0803","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0803"},{"cveID":"CVE-2019-0797","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0797","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0797"},{"cveID":"CVE-2019-0708","vendorProject":"Microsoft","product":"Remote Desktop Services","vulnerabilityName":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0708","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0708"},{"cveID":"CVE-2019-0604","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0604"},{"cveID":"CVE-2019-0541","vendorProject":"Microsoft","product":"MSHTML","vulnerabilityName":"Microsoft MSHTML Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0541","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0541"},{"cveID":"CVE-2018-8653","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8653","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-8653"},{"cveID":"CVE-2018-0802","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0802","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-0802"},{"cveID":"CVE-2018-0798","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0798","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-0798"},{"cveID":"CVE-2017-8759","vendorProject":"Microsoft","product":".NET Framework","vulnerabilityName":"Microsoft .NET Framework Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-8759","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-8759"},{"cveID":"CVE-2017-7269","vendorProject":"Microsoft","product":"Internet Information Services (IIS)","vulnerabilityName":"Microsoft Windows Server Buffer Overflow Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with \"If: <http://\" in a PROPFIND request.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-7269","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-7269"},{"cveID":"CVE-2017-11882","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-11882"},{"cveID":"CVE-2017-11774","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Outlook Security Feature Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11774","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-11774"},{"cveID":"CVE-2017-0199","vendorProject":"Microsoft","product":"Office and WordPad","vulnerabilityName":"Microsoft Office and WordPad Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-0199"},{"cveID":"CVE-2017-0143","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-0143"},{"cveID":"CVE-2016-7255","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7255","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-7255"},{"cveID":"CVE-2016-3235","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office OLE DLL Side Loading Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-264"],"shortDescription":"Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3235","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-3235"},{"cveID":"CVE-2016-0185","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Media Center Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0185","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-0185"},{"cveID":"CVE-2016-0167","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0167","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-0167"},{"cveID":"CVE-2015-1641","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-399"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1641","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2015-1641"},{"cveID":"CVE-2014-1812","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-255"],"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2014-1812"},{"cveID":"CVE-2012-0158","vendorProject":"Microsoft","product":"MSCOMCTL.OCX","vulnerabilityName":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2012-0158"}]}