Vulnerabilidades em Microsoft Corporation

865 resultados
Análise Vexday

Com 30 CVEs confirmadas em exploração ativa no catálogo CISA KEV, a Microsoft Corporation apresenta uma taxa de exploração 7,7 vezes acima da média geral do catálogo, o que indica exposição operacional significativamente elevada em relação ao universo de vendors monitorados. O tipo de falha mais recorrente é CWE-119 (corrupção de memória por escrita ou leitura fora dos limites), padrão historicamente associado a impacto elevado e exploração confiável em ambientes reais. A CVE mais perigosa atualmente ativa é CVE-2017-11882, com EPSS de 0,9995 — praticamente a probabilidade máxima de exploração —, sinalizando que esta vulnerabilidade específica deve ser tratada como prioridade imediata em qualquer programa de gestão de patches. A presença de 216 CVEs com prova de conceito pública, num universo total de 865 registros, amplia a superfície de risco para organizações que ainda não tenham aplicado as correções disponíveis.

CVE-2017-0122—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0092—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0128—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0111—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0117—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0124—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0127—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-0085—Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive EPSS 22.5%CVE-2017-8550—A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "SkypeEPSS 22.4%CVE-2017-0210HIGHAn elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an EPSS 22.3%KEVCVE-2017-8512—A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office REPSS 22.1%CVE-2017-8510—A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office REPSS 22.1%CVE-2017-8743—A remote code execution vulnerability exists in Microsoft PowerPoint 2016, Microsoft SharePoint Enterprise Server 2016, and Office Online SeEPSS 22.1%CVE-2017-8742—A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, MicrosofEPSS 22.1%CVE-2017-8728—Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, anEPSS 21.5%CVE-2017-8737—Microsoft Windows PDF Library in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, anEPSS 21.5%CVE-2017-0243—Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office RemoteEPSS 21.5%CVE-2017-8699—Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, WindowEPSS 21.3%CVE-2018-0878LOWWindows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2EPSS 21.1%CVE-2017-8630—Microsoft Office 2016 allows a remote code execution vulnerability when it fails to properly handle objects in memory, aka "Microsoft OfficeEPSS 21.0%