Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
897 results · page 7 of 18
Jan 11, 2022Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2022-21930 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2022-21929 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 2.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2021-43221 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Microsoft Edge for iOS Spoofing VulnerabilityCVE-2021-43220 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge for iOS Spoofing Vulnerability
- Product
- Microsoft Edge for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2021-42308 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Microsoft Edge (Chrome based) Spoofing on IE ModeCVE-2021-41351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chrome based) Spoofing on IE Mode
- Product
- Microsoft Edge (Chromium-based) in IE Mode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 15, 2021Microsoft Edge (Chromium-based) Tampering VulnerabilityCVE-2021-38669 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.4
Microsoft Edge (Chromium-based) Tampering Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30624 Use after free in AutofillCVE-2021-30624 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30624 Use after free in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30623 Use after free in BookmarksCVE-2021-30623 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30623 Use after free in Bookmarks
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30622 Use after free in WebApp InstallsCVE-2021-30622 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30622 Use after free in WebApp Installs
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30621 UI Spoofing in AutofillCVE-2021-30621 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30621 UI Spoofing in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30620 Insufficient policy enforcement in BlinkCVE-2021-30620 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30620 Insufficient policy enforcement in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30619 UI Spoofing in AutofillCVE-2021-30619 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30619 UI Spoofing in Autofill
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30618 Inappropriate implementation in DevToolsCVE-2021-30618 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30617 Policy bypass in BlinkCVE-2021-30617 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30617 Policy bypass in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30616 Use after free in MediaCVE-2021-30616 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30616 Use after free in Media
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30615 Cross-origin data leak in NavigationCVE-2021-30615 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comMedium 6.5
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30614 Heap buffer overflow in TabStripCVE-2021-30614 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30613 Use after free in Base internalsCVE-2021-30613 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30613 Use after free in Base internals
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30612 Use after free in WebRTCCVE-2021-30612 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30612 Use after free in WebRTC
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30611 Use after free in WebRTCCVE-2021-30611 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30611 Use after free in WebRTC
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30610 Use after free in Extensions APICVE-2021-30610 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30610 Use after free in Extensions API
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30609 Use after free in Sign-InCVE-2021-30609 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30609 Use after free in Sign-In
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30608 Use after free in Web ShareCVE-2021-30608 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30608 Use after free in Web Share
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30607 Use after free in PermissionsCVE-2021-30607 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30607 Use after free in Permissions
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 3, 2021Chromium: CVE-2021-30606 Use after free in BlinkCVE-2021-30606 · Computers, phones & browsers · Microsoft · reported by chrome-cve-admin@google.comHigh 8.8
Chromium: CVE-2021-30606 Use after free in Blink
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgportal.msrc.microsoft.com
Sep 2, 2021Microsoft Edge for iOS Spoofing VulnerabilityCVE-2021-38642 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge for iOS Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 2, 2021Microsoft Edge for Android Spoofing VulnerabilityCVE-2021-38641 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge for Android Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 2, 2021Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-36930 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 2, 2021Microsoft Edge for Android Information Disclosure VulnerabilityCVE-2021-26439 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Microsoft Edge for Android Information Disclosure Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 2, 2021Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-26436 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Aug 26, 2021Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-36931 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Aug 26, 2021Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2021-36929 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Aug 26, 2021Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-36928 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 2021Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-33741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2021-24113 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Microsoft Edge for Android Information Disclosure VulnerabilityCVE-2021-24100 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Microsoft Edge for Android Information Disclosure Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Microsoft Edge (HTML-based) Memory Corruption VulnerabilityCVE-2021-1705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (HTML-based) Memory Corruption Vulnerability
- Product
- Microsoft Edge (EdgeHTML-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2020Microsoft Edge for Android Spoofing VulnerabilityCVE-2020-17153 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for Android Spoofing Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 11, 2020<p>A remote code execution vulnerability exists in the way that the IEToEdge Browser Helper Object (BHO) plugin on Internet Explorer handles objects in memory.CVE-2020-16884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
<p>A remote code execution vulnerability exists in the way that the IEToEdge Browser Helper Object (BHO) plugin on Internet Explorer handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full us
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Sep 11, 2020Microsoft Edge and Internet Explorer Memory Corruption VulnerabilityCVE-2020-0878 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 4.2
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
- Product
- Edge and Internet Explorer
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 17, 2020A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory.CVE-2020-1569 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Mes
- Product
- Microsoft Edge (EdgeHTML-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 17, 2020A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory.CVE-2020-1568 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that contains malicious PDF content. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted PDF content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site. The securit
- Product
- Microsoft Edge (EdgeHTML-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 17, 2020A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based).CVE-2020-1555 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability. The security update addresses the vulnerability by modifying how the scripting engine handle
- Product
- ChakraCore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft EdCVE-2020-1462 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability'.
- Product
- Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for ARM64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2020An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information DisclosuCVE-2020-1433 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information Disclosure Vulnerability'.
- Product
- Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for ARM64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 9, 2020An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure VulnerabCVE-2020-1242 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnerability'.
- Product
- Microsoft Edge (EdgeHTML-based) on Windows 10 Version 2004 for x64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 9, 2020A spoofing vulnerability exists when theMicrosoft Edge (Chromium-based) in IE Mode improperly handles specific redirects, aka 'Microsoft Edge (Chromium-based) iCVE-2020-1220 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
A spoofing vulnerability exists when theMicrosoft Edge (Chromium-based) in IE Mode improperly handles specific redirects, aka 'Microsoft Edge (Chromium-based) in IE Mode Spoofing Vulnerability'.
- Product
- Microsoft Edge (Chromium-based) in IE Mode on Windows 10 Version 1803 for ARM64-based Systems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
May 21, 2020An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input.CVE-2020-1195 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.1
An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input. An attacker who successfully exploited this vulnerability could write files to arbitrary locations and gain elevated privileges. The vulnerability by itself does not allow arbitrary code to run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (for example a remote code execution vulnerability and another elevation of privilege vulnerability) to take advantage of the elevated privileges when running. The security update addresses the vulnerability by modifying how Microsoft Edge (Chromium-based) Feedback extension validates files.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 21, 2020A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory.CVE-2020-1096 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that contains malicious PDF content. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted PDF content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site. The securit
- Product
- Microsoft Edge (EdgeHTML-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.