Microsoft Office Memory Corruption Vulnerability

Windows Diagnostics Hub Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Graphics Component Font Parsing Elevation of Privilege Vulnerability

Microsoft Browser Memory Corruption Vulnerability

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

GDI+ Remote Code Execution Vulnerability

GDI+ Remote Code Execution Vulnerability

Internet Explorer Security Feature Bypass Vulnerability

Microsoft Browser Information Disclosure Vulnerability

Scripting Engine Memory Corruption Vulnerability