Microsoft security briefs
3328 published alerts for Microsoft products and services.
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-41073). Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. CISA remediation due date: 2022-12-09. If you need help checking exposure, call (864) 335-9223.
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-41082). Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. CISA remediation due date: 2022-10-21. If you need help checking exposure, call (864) 335-9223.
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-41040). Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. CISA remediation due date: 2022-10-21. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-37969). Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. CISA remediation due date: 2022-10-05. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-30190). A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. CISA remediation due date: 2022-07-05. If you need help checking exposure, call (864) 335-9223.
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft Silverlight is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2016-0034). Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS). CISA remediation due date: 2022-06-15. If you need help checking exposure, call (864) 335-9223.
Microsoft Silverlight Double Dereference Vulnerability
Microsoft Silverlight is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2013-0074). Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application. CISA remediation due date: 2022-06-15. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows SMBv1 Information Disclosure Vulnerability
Microsoft SMBv1 server is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2017-0147). The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet. CISA remediation due date: 2022-06-14. If you need help checking exposure, call (864) 335-9223.
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Microsoft Internet Explorer and Edge is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2016-3351). An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. CISA remediation due date: 2022-06-14. If you need help checking exposure, call (864) 335-9223.
Microsoft Update Notification Manager Privilege Escalation Vulnerability
Microsoft Update Notification Manager is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2020-0638). Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation. CISA remediation due date: 2022-06-13. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2019-1385). A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. CISA remediation due date: 2022-06-13. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2019-1130). A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. CISA remediation due date: 2022-06-13. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-24521). Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. CISA remediation due date: 2022-05-04. If you need help checking exposure, call (864) 335-9223.
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft Active Directory is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2021-42287). Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA remediation due date: 2022-05-02. If you need help checking exposure, call (864) 335-9223.
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft Active Directory is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2021-42278). Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA remediation due date: 2022-05-02. If you need help checking exposure, call (864) 335-9223.
Microsoft SMBv1 Server Remote Code Execution Vulnerability
Microsoft SMBv1 server is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2017-0148). The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. CISA remediation due date: 2022-04-27. If you need help checking exposure, call (864) 335-9223.
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Office is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2021-38646). Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2018-8440). An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Microsoft DirectX Graphics Kernel (DXGKRNL) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2018-8406). An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Microsoft DirectX Graphics Kernel (DXGKRNL) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2018-8405). An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows Privilege Escalation Vulnerability
Microsoft Windows is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2017-0213). Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft Internet Explorer is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2016-0189). The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
Microsoft Client-Server Run-time Subsystem (CSRSS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2016-0151). The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.
Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft Internet Explorer is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2013-2551). Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object. CISA remediation due date: 2022-04-18. If you need help checking exposure, call (864) 335-9223.