A heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows remote code execution over the network. An attacker needs network access and a low-privilege account, such as any SQL login or application service account, and the attack complexity is high. Successful exploitation can lead to full compromise of the database server, and the scope change means the impact may reach beyond SQL Server.
Microsoft · SQL Server
Microsoft SQL Server contains a deserialization flaw (CWE-502) that allows an authorized attacker to execute code over the network. The attacker needs a valid login, but no action from a user is required, and the impact on confidentiality, integrity and availability is rated high. Microsoft has released fixes for the affected builds, and CISA's SSVC assessment rates exploitation as none, but risk remains for internet-facing or privileged instances.
Microsoft · SQL Server
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. The flaw is rated CVSS 8.8 by Microsoft. Exploitation requires that a user opens a crafted workspace, so the risk is mainly for developers and IT staff who open third-party code. Successful code execution runs as the logged-in user and can expose source code, credentials and tokens.
Microsoft · Visual Studio Code
A heap-based buffer overflow in Microsoft Office Visio, part of Microsoft 365 Apps and Office LTSC 2021/2024, allows an unauthorized attacker to execute code over a network. No privileges are required, but a user must interact, for example by opening a malicious Visio file received by email, download or shared drive. The CVSS base score is 8.8 (High).
Microsoft · Office Visio
Visual Studio Code versions from 1.0.0 up to 1.141.0 contain a path traversal flaw (CWE-22) that can allow remote code execution. An attacker can exploit it by getting a developer to open a crafted workspace, folder, repository or project file, and no account is required. The CNA rates it 9.6 (Critical), while the CVE record is still awaiting NVD analysis.
Microsoft · Visual Studio Code
Microsoft Visual Studio Code contains an output encoding or escaping flaw (CWE-116). According to the CVE record, an unauthorized attacker can execute code over a network. The attack requires user interaction (CVSS UI:R), for example opening attacker-influenced content, and no authentication. Secondary sources describe specially crafted content in the integrated terminal, which is not yet confirmed by Microsoft.
Microsoft · Visual Studio Code
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
