{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1565 Data Manipulation","home_page_url":"https://patchfirst.co/technique/T1565/","feed_url":"https://patchfirst.co/feed/technique/T1565.json","description":"New and newly exploited CVEs that lead to ATT&CK T1565 Data Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-66384#kev","url":"https://patchfirst.co/cve/CVE-2026-66384/","title":"[KEV] CVE-2026-66384: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","content_text":"JFrog · Artifactory. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 0.7% (higher than 51.8% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 67.1 of 100.","summary":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","date_published":"2026-08-27T00:00:00.000Z","date_modified":"2026-10-24T16:10:00.000Z","tags":["kev","public-exploit","T1190","T1565"],"_patchfirst":{"reason":"kev","priority":67.1,"kev":{"dateAdded":"2026-08-27","ransomware":false},"epss":{"score":0.00665,"percentile":0.51756},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"JFrog","product":"Artifactory","techniqueIds":["T1190","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-32201#kev","url":"https://patchfirst.co/cve/CVE-2026-32201/","title":"[KEV] CVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerability","content_text":"Microsoft · SharePoint Server. In CISA KEV since 2026-04-14. ENISA EUVD lists it as exploited. EPSS 43.4% (higher than 98.7% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 72.3 of 100.","summary":"Microsoft SharePoint Server Improper Input Validation Vulnerability","date_published":"2026-04-14T00:00:00.000Z","date_modified":"2026-10-26T22:10:00.000Z","tags":["kev","public-exploit","T1190","T1565"],"_patchfirst":{"reason":"kev","priority":72.3,"kev":{"dateAdded":"2026-04-14","ransomware":false},"epss":{"score":0.43378,"percentile":0.9873},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"SharePoint Server","techniqueIds":["T1190","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-24993#kev","url":"https://patchfirst.co/cve/CVE-2025-24993/","title":"[KEV] CVE-2025-24993: Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.2% (higher than 82.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1203 Exploitation for Client Execution; T1204 User Execution; T1055 Process Injection; T1565 Data Manipulation. Priority 60.0 of 100.","summary":"Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1068","T1203","T1204","T1055","T1565"],"_patchfirst":{"reason":"kev","priority":60,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.02216,"percentile":0.82616},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1203","T1204","T1055","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-28434#kev","url":"https://patchfirst.co/cve/CVE-2023-28434/","title":"[KEV] CVE-2023-28434: MinIO Security Feature Bypass Vulnerability","content_text":"MinIO · MinIO. In CISA KEV since 2023-09-19. ENISA EUVD lists it as exploited. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1565 Data Manipulation. Priority 68.1 of 100.","summary":"MinIO Security Feature Bypass Vulnerability","date_published":"2023-09-19T00:00:00.000Z","date_modified":"2026-06-17T05:47:43.000Z","tags":["kev","public-exploit","T1078","T1565"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2023-09-19","ransomware":false},"epss":{"score":0.07917,"percentile":0.94716},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"MinIO","product":"MinIO","techniqueIds":["T1078","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2015-4902#kev","url":"https://patchfirst.co/cve/CVE-2015-4902/","title":"[KEV] CVE-2015-4902: Oracle Java SE Integrity Check Vulnerability","content_text":"Oracle · Java SE. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1565 Data Manipulation; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 64.9 of 100.","summary":"Oracle Java SE Integrity Check Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-17T00:28:08.000Z","tags":["kev","T1565","T1190"],"_patchfirst":{"reason":"kev","priority":64.9,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.13603,"percentile":0.96465},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Oracle","product":"Java SE","techniqueIds":["T1565","T1190"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-31207#kev","url":"https://patchfirst.co/cve/CVE-2021-31207/","title":"[KEV] CVE-2021-31207: Microsoft Exchange Server Security Feature Bypass Vulnerability","content_text":"Microsoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.95% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1548.002 Bypass User Account Control; T1565 Data Manipulation. Named in 9 threat reports. Priority 87.6 of 100.","summary":"Microsoft Exchange Server Security Feature Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:51:27.000Z","tags":["kev","ransomware","public-exploit","T1548.002","T1565"],"_patchfirst":{"reason":"kev","priority":87.6,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99782,"percentile":0.99955},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Exchange Server","techniqueIds":["T1548.002","T1565"],"reportCount":9,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8599#kev","url":"https://patchfirst.co/cve/CVE-2020-8599/","title":"[KEV] CVE-2020-8599: Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability","content_text":"Trend Micro · Apex One and OfficeScan. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 11.9% (higher than 96.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 64.1 of 100.","summary":"Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:37.000Z","tags":["kev","T1190","T1565"],"_patchfirst":{"reason":"kev","priority":64.1,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.11858,"percentile":0.9609},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Trend Micro","product":"Apex One and OfficeScan","techniqueIds":["T1190","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-16874","url":"https://patchfirst.co/cve/CVE-2020-16874/","title":"CVE-2020-16874: Visual Studio Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6). Not in CISA KEV. EPSS 4.3% (higher than 91.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 24.4 of 100.","summary":"Visual Studio Remote Code Execution Vulnerability","date_published":"2020-09-11T00:00:00.000Z","date_modified":"2024-08-04T13:45:34.000Z","tags":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.4,"kev":null,"epss":{"score":0.04285,"percentile":0.91102},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)","techniqueIds":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1569","url":"https://patchfirst.co/cve/CVE-2020-1569/","title":"CVE-2020-1569: Microsoft Edge Memory Corruption Vulnerability","content_text":"Microsoft · Microsoft Edge (EdgeHTML-based). Not in CISA KEV. EPSS 3.0% (higher than 87.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 23.6 of 100.","summary":"Microsoft Edge Memory Corruption Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":23.6,"kev":null,"epss":{"score":0.02984,"percentile":0.87281},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Edge (EdgeHTML-based)","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1495","url":"https://patchfirst.co/cve/CVE-2020-1495/","title":"CVE-2020-1495: Microsoft Excel Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft SharePoint Server 2010 Service Pack 2. Not in CISA KEV. EPSS 4.2% (higher than 91% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 18.9 of 100.","summary":"Microsoft Excel Remote Code Execution Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.04212,"percentile":0.90969},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Server 2010 Service Pack 2","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15109","url":"https://patchfirst.co/cve/CVE-2020-15109/","title":"CVE-2020-15109: Ability to change order address without triggering address validations in solidus","content_text":"solidusio · solidus. Not in CISA KEV. EPSS 1.0% (higher than 62.7% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 16.3 of 100.","summary":"Ability to change order address without triggering address validations in solidus","date_published":"2020-08-04T00:00:00.000Z","date_modified":"2024-08-04T13:08:21.000Z","tags":["T1133","T1190","T1565"],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00999,"percentile":0.62745},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"solidusio","product":"solidus","techniqueIds":["T1133","T1190","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1456","url":"https://patchfirst.co/cve/CVE-2020-1456/","title":"CVE-2020-1456: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","content_text":"Microsoft · Microsoft SharePoint Enterprise Server. Not in CISA KEV. EPSS 2.2% (higher than 82.7% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 21.0 of 100.","summary":"A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","date_published":"2020-07-14T00:00:00.000Z","date_modified":"2025-02-28T20:32:04.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.02229,"percentile":0.82723},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1109","url":"https://patchfirst.co/cve/CVE-2020-1109/","title":"CVE-2020-1109: Windows Update Stack Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1709. Not in CISA KEV. EPSS 1.0% (higher than 62.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 18.0 of 100.","summary":"Windows Update Stack Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18,"kev":null,"epss":{"score":0.00994,"percentile":0.6259},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1709","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1068","url":"https://patchfirst.co/cve/CVE-2020-1068/","title":"CVE-2020-1068: Microsoft Windows Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1507. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1565 Data Manipulation. Priority 17.7 of 100.","summary":"Microsoft Windows Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:33:52.000Z","tags":["T1565"],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.00952,"percentile":0.61291},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1507","techniqueIds":["T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1111","url":"https://patchfirst.co/cve/CVE-2020-1111/","title":"CVE-2020-1111: Windows Clipboard Service Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1809. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 17.7 of 100.","summary":"Windows Clipboard Service Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.00952,"percentile":0.61289},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1809","techniqueIds":["T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-0671","url":"https://patchfirst.co/cve/CVE-2020-0671/","title":"CVE-2020-0671: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 1.4% (higher than 71.8% of CVEs). ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.0 of 100.","summary":"An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","date_published":"2020-02-11T00:00:00.000Z","date_modified":"2024-08-04T06:11:04.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15,"kev":null,"epss":{"score":0.01367,"percentile":0.7182},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5225","url":"https://patchfirst.co/cve/CVE-2020-5225/","title":"CVE-2020-5225: Log injection in SimpleSAMLphp","content_text":"simplesamlphp · SimpleSAMLphp. Not in CISA KEV. EPSS 0.7% (higher than 51.5% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1565 Data Manipulation. Priority 13.4 of 100.","summary":"Log injection in SimpleSAMLphp","date_published":"2020-01-24T00:00:00.000Z","date_modified":"2024-08-04T08:22:08.000Z","tags":["T1565"],"_patchfirst":{"reason":"published","priority":13.4,"kev":null,"epss":{"score":0.00659,"percentile":0.51499},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1"},"vendor":"simplesamlphp","product":"SimpleSAMLphp","techniqueIds":["T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1423","url":"https://patchfirst.co/cve/CVE-2019-1423/","title":"CVE-2019-1423: An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in…","content_text":"Microsoft · Windows 10 Version 1903 for 32-bit Systems. Not in CISA KEV. EPSS 1.4% (higher than 73% of CVEs). ATT&CK: T1565 Data Manipulation; T1068 Exploitation for Privilege Escalation. Priority 15.3 of 100.","summary":"An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in…","date_published":"2019-11-12T00:00:00.000Z","date_modified":"2024-08-04T18:20:27.000Z","tags":["T1565","T1068"],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.01429,"percentile":0.72965},"cvss":null,"vendor":"Microsoft","product":"Windows 10 Version 1903 for 32-bit Systems","techniqueIds":["T1565","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1270","url":"https://patchfirst.co/cve/CVE-2019-1270/","title":"CVE-2019-1270: An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). ATT&CK: T1202 Indirect Command Execution; T1485 Data Destruction; T1565 Data Manipulation. Priority 11.9 of 100.","summary":"An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…","date_published":"2019-09-11T00:00:00.000Z","date_modified":"2024-08-04T18:13:30.000Z","tags":["T1202","T1485","T1565"],"_patchfirst":{"reason":"published","priority":11.9,"kev":null,"epss":{"score":0.00897,"percentile":0.59559},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1202","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1118","url":"https://patchfirst.co/cve/CVE-2019-1118/","title":"CVE-2019-1118: A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 23.6% (higher than 97.8% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.6 of 100.","summary":"A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","date_published":"2019-07-29T00:00:00.000Z","date_modified":"2024-08-04T18:06:31.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.6,"kev":null,"epss":{"score":0.2357,"percentile":0.97801},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1031","url":"https://patchfirst.co/cve/CVE-2019-1031/","title":"CVE-2019-1031: Microsoft Office SharePoint XSS Vulnerability","content_text":"Microsoft · Microsoft SharePoint Enterprise Server 2016. Not in CISA KEV. EPSS 1.7% (higher than 76.7% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.3 of 100.","summary":"Microsoft Office SharePoint XSS Vulnerability","date_published":"2019-06-12T00:00:00.000Z","date_modified":"2025-05-20T17:50:11.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.01662,"percentile":0.76671},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-0609","url":"https://patchfirst.co/cve/CVE-2019-0609/","title":"CVE-2019-0609: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · Internet Explorer 11. Not in CISA KEV. EPSS 9.8% (higher than 95.6% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.8 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2019-04-08T00:00:00.000Z","date_modified":"2024-08-04T17:51:26.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.09846,"percentile":0.95554},"cvss":null,"vendor":"Microsoft","product":"Internet Explorer 11","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8575","url":"https://patchfirst.co/cve/CVE-2018-8575/","title":"CVE-2018-8575: A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","content_text":"Microsoft · Microsoft Project. Not in CISA KEV. EPSS 19.5% (higher than 97.4% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.19546,"percentile":0.97377},"cvss":null,"vendor":"Microsoft","product":"Microsoft Project","techniqueIds":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8607","url":"https://patchfirst.co/cve/CVE-2018-8607/","title":"CVE-2018-8607: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","content_text":"Microsoft · Microsoft Dynamics 365. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.2 of 100.","summary":"A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.01605,"percentile":0.75832},"cvss":null,"vendor":"Microsoft","product":"Microsoft Dynamics 365","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8431","url":"https://patchfirst.co/cve/CVE-2018-8431/","title":"CVE-2018-8431: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially…","content_text":"Microsoft · Microsoft SharePoint Server. Not in CISA KEV. EPSS 2.3% (higher than 82.9% of CVEs). ATT&CK: T1190 Exploit Public-Facing Application; T1565 Data Manipulation. Priority 16.6 of 100.","summary":"An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially…","date_published":"2018-09-13T00:00:00.000Z","date_modified":"2024-08-05T06:54:36.000Z","tags":["T1190","T1565"],"_patchfirst":{"reason":"published","priority":16.6,"kev":null,"epss":{"score":0.02253,"percentile":0.82907},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Server","techniqueIds":["T1190","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8353","url":"https://patchfirst.co/cve/CVE-2018-8353/","title":"CVE-2018-8353: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","content_text":"Not in CISA KEV. EPSS 67.3% (higher than 99.3% of CVEs). Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67339,"percentile":0.99304},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8355","url":"https://patchfirst.co/cve/CVE-2018-8355/","title":"CVE-2018-8355: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · ChakraCore. Not in CISA KEV. EPSS 67.9% (higher than 99.32% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67896,"percentile":0.9932},"cvss":null,"vendor":"Microsoft","product":"ChakraCore","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8248","url":"https://patchfirst.co/cve/CVE-2018-8248/","title":"CVE-2018-8248: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","content_text":"Microsoft · Microsoft Office. Not in CISA KEV. EPSS 21.4% (higher than 97.6% of CVEs). ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.21421,"percentile":0.97607},"cvss":null,"vendor":"Microsoft","product":"Microsoft Office","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8110","url":"https://patchfirst.co/cve/CVE-2018-8110/","title":"CVE-2018-8110: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97.1% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.97051},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8111","url":"https://patchfirst.co/cve/CVE-2018-8111/","title":"CVE-2018-8111: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.9705},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}