Exposure of Windows Server

Operating systems
1,432
exposure score
228,411
sites use
32
exploited
3
critical
Vexday analysis

Windows Server acumula 831 CVEs catalogadas, das quais 33 estão confirmadas em exploração ativa no catálogo KEV da CISA — uma taxa 8,8 vezes acima da média geral do catálogo, o que indica exposição operacional significativamente elevada. A CVE mais perigosa em atividade, CVE-2019-0708, registra EPSS de 1,0, sinalizando probabilidade máxima de exploração e exigindo atenção prioritária em ambientes que ainda não aplicaram a correção correspondente. O tipo de falha mais recorrente é CWE-59 (improper link resolution before file access, ou "link following"), sugerindo que controles de integridade de sistema de arquivos e privilégios de acesso devem compor a linha de defesa prioritária. Embora nenhuma CVE nova tenha surgido nos últimos 90 dias, o perfil histórico da plataforma — com 3 falhas críticas ativas e EPSS máximo observado de 0,99999 — reforça a necessidade de gestão contínua e rigorosa de patches.

CVEs

755 results
CVE-2019-1337—An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update ClEPSS 2.2%CVE-2019-1363—An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowiEPSS 2.2%CVE-2019-0848—An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisEPSS 2.1%CVE-2019-0844—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 2.1%CVE-2019-0840—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 2.1%CVE-2019-0814—An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisEPSS 2.1%CVE-2020-0965—A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft WinEPSS 2.1%CVE-2019-1440—An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisEPSS 2.1%CVE-2019-0837—An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerEPSS 2.1%CVE-2019-1422—An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'WiEPSS 2.1%CVE-2019-1293—An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects inEPSS 2.1%CVE-2019-0621—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 2.1%CVE-2019-0628—An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisEPSS 2.1%CVE-2019-0661—An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationEPSS 2.1%CVE-2019-0838—An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aEPSS 2.1%CVE-2019-0636—An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'.EPSS 2.0%CVE-2019-1091—An information disclosure vulnerability exists when Unistore.dll fails to properly handle objects in memory, aka 'Microsoft unistore.dll InfEPSS 2.0%CVE-2019-0701—A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on EPSS 1.9%CVE-2019-0695—A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on EPSS 1.9%CVE-2019-0690—A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privEPSS 1.9%