CVEs published November 14, 2018
157 CVEs were published on November 14, 2018: 0 critical, 4 high. 4 are now in CISA KEV.
- Published
- 157
- Critical
- 0
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 150
- Now in CISA KEV
- 4
- Fix available
- 52
Most affected products
- Google Chrome
- 38
- Google Android
- 27
- Microsoft Windows
- 9
- Microsoft Edge · Microsoft ChakraCore +1
- 8
- Nagios XI
- 7
- Microsoft Windows Server · Microsoft Windows
- 5
- Microsoft Dynamics
- 4
- Microsoft Office · Microsoft Outlook
- 4
- centreon/centreon
- 3
- Microsoft Edge
- 3
High 4
- CVE-2018-17463Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sGoogle Chrome
- CVE-2018-6065Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3Google Chrome
- CVE-2018-8581An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2018-8589An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of PrivileMicrosoft Windows Server · Microsoft Windows
Medium, low and unrated 153
- CVE-2018-17960CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.ckeditor · typo3/cms-core +1
- CVE-2018-19278Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash A
- CVE-2018-19279PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files.
- CVE-2018-19280Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.centreon/centreon
- CVE-2018-19281Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.centreon/centreon
- CVE-2018-5495All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with systNetApp StorageGRID Webscale
- CVE-2018-15708Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.Nagios XI
- CVE-2018-15709Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.Nagios XI
- CVE-2018-15710Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.Nagios XI
- CVE-2018-15711Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users.Nagios XI
- CVE-2018-15712Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.Nagios XI
- CVE-2018-15713Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.Nagios XI
- CVE-2018-15714Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.Nagios XI
- CVE-2018-9347In function SMF_ParseMetaEvent of file eas_smf.c there is incorrect input validation causing an infinite loop.Google Android
- CVE-2018-9457In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass.Google Android
- CVE-2018-9521In parseMPEGCCData of NuPlayer2CCDecoder.cpp, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9522In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which Google Android
- CVE-2018-9523In Parcel.writeMapInternal of Parcel.java, there is a possible parcel serialization/deserialization mismatch due to improper input validatioGoogle Android
- CVE-2018-9524In functionality implemented in System UI, there are insufficient protections implemented around overlay windows.Google Android
- CVE-2018-9525In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a pGoogle Android
- CVE-2018-9526In device configuration data, there is an improperly configured setting.Google Android
- CVE-2018-9527In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check.Google Android
- CVE-2018-9528In ixheaacd_over_lap_add1_armv8 of ixheaacd_overlap_add1.s there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9529In ixheaacd_individual_ch_stream of ixheaacd_channel.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9530In ixheaacd_tns_ar_filter_dec of ixheaacd_aac_tns.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9531In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check.Google Android
- CVE-2018-9532In ixheaacd_extract_frame_info_ld of ixheaacd_env_extr.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9533In ixheaacd_dec_data_init of ixheaacd_create.c there is a possible out of write read due to a missing bounds check.Google Android
- CVE-2018-9534In ixheaacd_mps_getstridemap of ixheaacd_mps_parse.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9535In ixheaacd_reset_acelp_data_fix of ixheaacd_lpc.c there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2018-9536In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks.Google Android
- CVE-2018-9537In CAacDecoder_DecodeFrame of aacdecode.cpp, there is a possible out-of-bounds write due to a missing bounds check.Google Android
- CVE-2018-9539In the ClearKey CAS descrambler, there is a possible use after free due to a race condition.Google Android
- CVE-2018-9540In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9541In avrc_pars_vendor_rsp of avcr_pars_ct.cc, there is a possible out-of-bounds read due to a missing bounds check.Google Android
- CVE-2018-9542In avrc_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9543In trim_device of f2fs_format_utils.c, it is possible that the data partition is not wiped during a factory reset.Google Android
- CVE-2018-9544In register_app of btif_hd.cc, there is a possible out-of-bounds read due to a missing bounds check.Google Android
- CVE-2018-9545In BTA_HdRegisterApp of bta_hd_api.cc, there is a possible out-of-bound write due to a missing bounds check.Google Android
- CVE-2018-9580A Elevation of privilege vulnerability in the HTC bootloader.Google Android
- CVE-2018-17462Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a craftedGoogle Chrome
- CVE-2018-17464Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents ofGoogle Chrome
- CVE-2018-17465Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit obGoogle Chrome
- CVE-2018-17466Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory readGoogle Chrome
- CVE-2018-17467Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spGoogle Chrome
- CVE-2018-17468Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtaiGoogle Chrome
- CVE-2018-17469Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounGoogle Chrome
- CVE-2018-17471Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warninGoogle Chrome
- CVE-2018-17472Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escapGoogle Chrome
- CVE-2018-17473Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2018-17474Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heaGoogle Chrome
- CVE-2018-17475Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents ofGoogle Chrome
- CVE-2018-17476Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning viGoogle Chrome
- CVE-2018-17477Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extensionGoogle Chrome
- CVE-2018-6057Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2018-6060Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2018-6061A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentiallyGoogle Chrome
- CVE-2018-6062Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via aGoogle Chrome
- CVE-2018-6063Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised Google Chrome
- CVE-2018-6064Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentiaGoogle Chrome
- CVE-2018-6066Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cGoogle Chrome
- CVE-2018-6067Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2018-6068Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the OGoogle Chrome
- CVE-2018-6069Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via Google Chrome
- CVE-2018-6070Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2018-6071An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a Google Chrome
- CVE-2018-6072An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exp
- CVE-2018-6073A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write vGoogle Chrome
- CVE-2018-6074Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls Google Chrome
- CVE-2018-6075Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-Google Chrome
- CVE-2018-6076Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOGoogle Chrome
- CVE-2018-6077Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remotGoogle Chrome
- CVE-2018-6078Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contenGoogle Chrome
- CVE-2018-6079Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attGoogle Chrome
- CVE-2018-6080Lack of access control checks in Instrumentation in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2018-6081XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a maliciousGoogle Chrome
- CVE-2018-6082Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potent
- CVE-2018-6083Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attackGoogle Chrome
- CVE-2018-7357ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerabZTE ZXHN H168N
- CVE-2018-7358ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerabZTE ZXHN H168N
- CVE-2018-12174Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalateIntel Parallel Studio XE
- CVE-2018-3621Insufficient input validation in the Intel Driver & Support Assistant before 3.6.0.4 may allow an unauthenticated user to potentially enableIntel Driver & Support Assistant
- CVE-2018-3635Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to potenIntel Rapid Store Technology
- CVE-2018-3696Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administraIntel RAID Web Console v3 for Windows
- CVE-2018-3697Improper directory permissions in the installer for the Intel Media Server Studio may allow unprivileged users to potentially enable an escaIntel Media Server Studio
- CVE-2018-3698Improper file permissions in the installer for the Intel Ready Mode Technology may allow an unprivileged user to potentially gain privilegedIntel Ready Mode Technology
- CVE-2018-3699Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access.Intel RAID Web Console
- CVE-2018-19271Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.centreon/centreon
- CVE-2018-19277securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx filephpoffice/phpspreadsheet · phpoffice/phpexcel
- CVE-2018-19186The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.
- CVE-2018-19187The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandle
- CVE-2018-19188The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.
- CVE-2018-19189The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandle
- CVE-2018-19190The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.
- CVE-2018-8256A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote CoMicrosoft Windows · Microsoft.PowerShell.Archive +1
- CVE-2018-8407An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory,Microsoft Windows
- CVE-2018-8408An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel InformaMicrosoft Windows
- CVE-2018-8415A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering VuMicrosoft Windows · Microsoft PowerShell Core
- CVE-2018-8416A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This afMicrosoft .NET Core · Microsoft.NETCore.App
- CVE-2018-8417A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard, aka "Microsoft JScrMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8450A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution VulnerMicrosoft Windows
- CVE-2018-8454An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio SerMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8471An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory,Microsoft Windows Server · Microsoft Windows
- CVE-2018-8476A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "WindowsMicrosoft Windows Server 2012 R2 · Microsoft Windows Ser… +1
- CVE-2018-8485An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege VulnerMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8522A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "MicrosofMicrosoft Office · Microsoft Outlook
- CVE-2018-8524A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "MicrosofMicrosoft Office · Microsoft Outlook
- CVE-2018-8539A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft WMicrosoft SharePoint Server · Microsoft Office
- CVE-2018-8541A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8542A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8543A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8544A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows
- CVE-2018-8545An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka "Microsoft Edge InformationMicrosoft Edge
- CVE-2018-8546A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This affMicrosoft Skype · Microsoft Office +1
- CVE-2018-8547A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8549A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerabi
- CVE-2018-8550An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Wi
- CVE-2018-8551A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8552An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attackeMicrosoft Internet Explorer
- CVE-2018-8553A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft GraphicsMicrosoft Windows
- CVE-2018-8554An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege VulnerMicrosoft Windows 10 Servers · Microsoft Windows
- CVE-2018-8555A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8556A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8557A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8558An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the ShareMicrosoft Office
- CVE-2018-8561An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege VulnerMicrosoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2018-8562An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2018-8563An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure VulnerMicrosoft Windows
- CVE-2018-8564A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." TMicrosoft Edge
- CVE-2018-8565An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information DisMicrosoft Windows
- CVE-2018-8566A security feature bypass vulnerability exists when Windows improperly suspends BitLocker Device Encryption, aka "BitLocker Security FeatureMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8567An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attMicrosoft Edge
- CVE-2018-8568An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8570A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2018-8572An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request tMicrosoft SharePoint Server · Microsoft SharePoint
- CVE-2018-8573A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft WMicrosoft Word · Microsoft Office
- CVE-2018-8574A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8575A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "MicrosofMicrosoft Project · Microsoft Office
- CVE-2018-8576A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "MicrosofMicrosoft Office · Microsoft Outlook
- CVE-2018-8577A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Office · Microsoft Excel
- CVE-2018-8578An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering speMicrosoft SharePoint
- CVE-2018-8579An information disclosure vulnerability exists when attaching files to Outlook messages, aka "Microsoft Outlook Information Disclosure VulneMicrosoft Office
- CVE-2018-8582A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft OMicrosoft Office · Microsoft Outlook
- CVE-2018-8584An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows AMicrosoft Windows Server · Microsoft Windows
- CVE-2018-8588A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2018-8592An elevation of privilege vulnerability exists in Windows 10 version 1809 when installed from physical media (USB, DVD, etc, aka "Windows ElMicrosoft Windows
- CVE-2018-8600A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, akaMicrosoft Azure App
- CVE-2018-8602A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team FounMicrosoft Team
- CVE-2018-8605A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craft
- CVE-2018-8606A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craftMicrosoft Dynamics
- CVE-2018-8607A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craftMicrosoft Dynamics
- CVE-2018-8608A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially craftMicrosoft Dynamics
- CVE-2018-8609A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize weMicrosoft Dynamics