Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2019-09-11	CVE-2019-0928	Improper Input Validation vulnerability in Microsoft Windows 10 and Windows Server 2016 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. low complexity microsoft CWE-20	6.2
2019-08-14	CVE-2019-1218	Cross-site Scripting vulnerability in Microsoft Outlook A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. network low complexity microsoft CWE-79	5.4
2019-08-14	CVE-2019-1204	Improper Input Validation vulnerability in Microsoft Office, Office 365 Proplus and Outlook An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. network low complexity microsoft CWE-20	4.3
2019-08-14	CVE-2019-1203	Cross-site Scripting vulnerability in Microsoft Sharepoint Enterprise Server and Sharepoint Server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. network low complexity microsoft CWE-79	5.4
2019-08-14	CVE-2019-1202	Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. local low complexity microsoft CWE-200	4.4
2019-07-29	CVE-2019-1105	Cross-site Scripting vulnerability in Microsoft Outlook A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'. network low complexity microsoft CWE-79	5.4
2019-07-19	CVE-2019-1167	Unspecified vulnerability in Microsoft Powershell Core 6.1/6.2 A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'. local high complexity microsoft	4.1
2019-07-15	CVE-2019-1137	Cross-site Scripting vulnerability in Microsoft Exchange Server 2013/2016/2019 A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'. network low complexity microsoft CWE-79	5.4
2019-07-15	CVE-2019-1134	Cross-site Scripting vulnerability in Microsoft Sharepoint Enterprise Server and Sharepoint Server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. network low complexity microsoft CWE-79	5.4
2019-07-15	CVE-2019-1126	Improper Restriction of Excessive Authentication Attempts vulnerability in Microsoft products A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an attacker could run a specially crafted application, which would allow an attacker to launch a password brute-force attack or cause account lockouts in Active Directory.This security update corrects how ADFS handles external authentication requests., aka 'ADFS Security Feature Bypass Vulnerability'. network low complexity microsoft CWE-307	5.3