Microsoft Security Center Center News

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.

Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.

Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.