CVE-2014-2781
published 2014-07-08CVE-2014-2781: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold…
PriorityP339high7.6CVSS 2.0
AVNACHAuNCCICAC
EPSS
6.02%
92.6th percentile
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the exchange of keyboard and mouse data between programs at different integrity levels, which allows attackers to bypass intended access restrictions by leveraging control over a low-integrity process to launch the On-Screen Keyboard (OSK) and then upload a crafted application, aka "On-Screen Keyboard Elevation of Privilege Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Microsoft Update Tuesday August 2014: Media Center and Internet Explorer
blogs_talos·2014-08-12·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday August 2014: Media Center and Internet Explorer
This month’s Microsoft Update Tuesday is relatively light compared to the major update of last month. We’re getting a total of six bulletins this month, two marked critical, three as important and finally one moderate. These six bulletins cover a total of 29 CVEs, most of which are, as is usual, in Internet Explorer.
Let’s start off with the Internet Explorer bulletin, MS14-037. It covers a total of 24 CVEs, 23 of which are memory corruption vulnerabilities that could result remote code execution vulnerabilities and most of those memory corruptions are the result use-after-free vulnerabilities. What’s interesting this month is that Microsoft has implemented a number of enhancements to IE that make particular use-after-free vulnerabilities non-exploitable. The one vulnerability (CVE-2014-2
Talos
Microsoft Update Tuesday August 2014: Media Center and Internet Explorer
blogs_talos·2014-08-12·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday August 2014: Media Center and Internet Explorer
## Microsoft Update Tuesday August 2014: Media Center and Internet Explorer
This month’s Microsoft Update Tuesday is relatively light compared to the major update of last month. We’re getting a total of six bulletins this month, two marked critical, three as important and finally one moderate. These six bulletins cover a total of 29 CVEs, most of which are, as is usual, in Internet Explorer.
Let’s start off with the Internet Explorer bulletin, MS14-037 . It covers a total of 24 CVEs, 23 of which are memory corruption vulnerabilities that could result remote code execution vulnerabilities and most of those memory corruptions are the result use-after-free vulnerabilities. What’s interesting this month is that Microsoft has implemented a number of enhancements to IE that make particular use
Talos
Microsoft Update Tuesday July 2014: light month, mostly Internet Explorer
blogs_talos·2014-07-08·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday July 2014: light month, mostly Internet Explorer
## Microsoft Update Tuesday July 2014: light month, mostly Internet Explorer
This month’s Microsoft Update Tuesday is relatively light compared to the major update of last month. We’re getting a total of six bulletins this month, two marked critical, three as important and finally one moderate. These six bulletins cover a total of 29 CVEs, most of which are, as is usual, in Internet Explorer.
Let’s start off with the Internet Explorer bulletin, MS14-037 . It covers a total of 24 CVEs, 23 of which are memory corruption vulnerabilities that could result remote code execution vulnerabilities and most of those memory corruptions are the result use-after-free vulnerabilities. What’s interesting this month is that Microsoft has implemented a number of enhancements to IE that make particular us
http://www.securityfocus.com/bid/68397http://www.securitytracker.com/id/1030535https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-039http://www.securityfocus.com/bid/68397http://www.securitytracker.com/id/1030535https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-039
2014-07-08
Published