Skip to main content
To Customer Support To Customer Support

Vulnerability Vault

Learn about new vulnerabilities in software, systems, devices, and share new patches, workarounds, and mitigation strategies.

  • 17 Topics
  • 111 Replies

Chipmaker Patch Tuesday: Intel, AMD Address New Microarchitectural Vuln...

  • 3
  • 0
Blog

Log4j Aftermath: Lessons Learned and Steps Forward for the Community an...

  • 3
  • 4
17 Topics
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft December 2024 Security Updates (Patch Tuesday)

This release consists of the following 72 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?System Center Operations Manager CVE-2024-43594Microsoft Office CVE-2024-43600Microsoft Edge (Chromium-based) CVE-2024-49041Microsoft Defender for Endpoint CVE-2024-49057Microsoft Office CVE-2024-49059Microsoft Office SharePoint CVE-2024-49062GitHub CVE-2024-49063Microsoft Office SharePoint CVE-2024-49064Microsoft Office Word CVE-2024-49065Microsoft Office SharePoint CVE-2024-49068Microsoft Office Excel CVE-2024-49069Microsoft Office SharePoint CVE-2024-49070Windows Task Scheduler CVE-2024-49072Windows Mobile Broadband CVE-2024-49073Windows Kernel-Mode Drivers CVE-2024-49074Windows Remote Desktop Services CVE-2024-49075Windows Virtualization-Based Security (VBS) Enclave CVE-2024-49076Windows Mobile Broadband CVE-2024-49077Windows Mobile Broadband CVE-2024-49078Microsoft Office Publisher CVE-2024-49079Windows IP Routing Management Snapin CVE-2024-49080Win

6512
TripleHelix
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Exploit Code Published for Potentially Dangerous Windows LDAP Vulnerability

Proof-of-concept (PoC) code was published for CVE-2024-49113, a denial-of-service (DoS) vulnerability in Windows LDAP. January 3, 2025 By Ionut Arghire SafeBreach has published proof-of-concept (PoC) exploit code targeting a recently resolved denial-of-service (DoS) vulnerability in Windows Lightweight Directory Access Protocol (LDAP).The issue, tracked as CVE-2024-49113 (CVSS score of 7.5), was patched on December 10 along with a critical remote code execution (RCE) flaw in LDAP (CVE-2024-49112, CVSS score of 9.8).Neither of the defects has been marked as exploited, but Microsoft warned that the RCE bug could allow unauthenticated attackers to execute arbitrary code using crafted LDAP calls, urging administrators to disconnect Domain Controllers from the internet to mitigate exposure. >>Full Article<<

112
Jasper_The_Rasper
Moderator
1 day ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft November 2024 Security Updates (Patch Tuesday)

This release consists of the following 89 Microsoft CVEs: Microsoft security update summary for November 2024November 12, 2024Here’s a summary of Microsoft security updates released on this date.Critical security updates.NET 9.0 installed on Linux .NET 9.0 installed on Mac OS .NET 9.0 installed on Windows Microsoft Visual Studio 2022 version 17.10 Microsoft Visual Studio 2022 version 17.11 Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 23H2 for ARM64-based Systems Windows 11 Version 23H2 for x64-based Systems Windows 11 Version 24H2 for ARM64-based Systems Windows 11 Version 24H2 for x64-based Systems Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server

507
TripleHelix
Moderator
30 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft October 2024 Security Updates (Patch Tuesday)

This is what I got for today on my Windows 10 Pro. More info will follow.  

11715
TripleHelix
Moderator
1 month ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft September 2024 Security Updates (Patch Tuesday)

This release consists of the following 79 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations? Windows TCP/IP CVE-2024-21416 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26186 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26191 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Security Zone Mapping CVE-2024-30073 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37335 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37337 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No

7813
TripleHelix
Moderator
3 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft August 2024 Security Updates (Patch Tuesday)

August 2024 Security UpdatesThis release consists of the following 90 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Windows Secure Kernel Mode CVE-2024-21302Windows Kerberos CVE-2024-29995Microsoft Windows DNS CVE-2024-37968Windows TCP/IP CVE-2024-38063Microsoft Office CVE-2024-38084Azure Connected Machine Agent CVE-2024-38098Windows Kernel CVE-2024-38106Windows Power Dependency Coordinator CVE-2024-38107Azure Stack CVE-2024-38108Azure Health Bot CVE-2024-38109Windows IP Routing Management Snapin CVE-2024-38114Windows IP Routing Management Snapin CVE-2024-38115Windows IP Routing Management Snapin CVE-2024-38116Windows NTFS CVE-2024-38117Microsoft Local Security Authority Server (lsasrv) CVE-2024-38118Windows Routing and Remote Access Service (RRAS) CVE-2024-38120Windows Routing and Remote Access Service (RRAS) CVE-2024-38121Microsoft Local Security Authority Server (lsasrv) CVE-2024-38122Microsoft Bluetooth Driver CVE-2024-38123Microsoft St

446
TripleHelix
Moderator
4 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft Discloses 10 Zero-Day Bugs in Patch Tuesday Update

August 13, 2024 Source: CC Photo Labs via Shutterstock  Attackers are actively exploiting as many as six of the 90 vulnerabilities that Microsoft disclosed in its security update for August, making them a top priority for administrators this Patch Tuesday.Another four CVEs in Microsoft's update were publicly known before the Aug. 13 disclosure, which also make them zero-days of a sort, even though attackers have not yet begun exploiting them. Among them, an elevation of privilege (EoP) bug in Windows Update Stack, tracked as CVE-2024-38202, is particularly troubling because Microsoft does not yet have a patch for it.Unpatched Zero-DayThe unpatched flaw allows an attacker with "basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS)," according to Microsoft. The company has assessed the bug as being only of moderate severity because an attacker would need to trick an administrator or user with delegated

40
TripleHelix
Moderator
4 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft June 2024 Security Updates (Patch Tuesday)

June 2024 Security UpdatesThis release consists of the following 49 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Visual Studio CVE-2024-29060Visual Studio CVE-2024-30052Windows Server Service CVE-2024-30062Windows Distributed File System (DFS) CVE-2024-30063Windows Kernel CVE-2024-30064Windows Themes CVE-2024-30065Winlogon CVE-2024-30066Winlogon CVE-2024-30067Windows Kernel CVE-2024-30068Windows Remote Access Connection Manager CVE-2024-30069Windows DHCP Server CVE-2024-30070Windows Event Logging Service CVE-2024-30072Windows Link Layer Topology Discovery Protocol CVE-2024-30074Windows Link Layer Topology Discovery Protocol CVE-2024-30075Windows Container Manager Service CVE-2024-30076Microsoft WDAC OLE DB provider for SQL CVE-2024-30077Windows Wi-Fi Driver CVE-2024-30078Windows Server Service CVE-2024-30080Windows Win32K - GRFX CVE-2024-30082Windows Standards-Based Storage Management Service CVE-2024-30083Windows Kernel-Mode Drivers CVE-2

496
TripleHelix
Moderator
6 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft May 2024 Security Updates (Patch Tuesday)

May 2024 Security UpdatesThis release consists of the following 60 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Windows Task Scheduler CVE-2024-26238Microsoft Windows SCSI Class System File CVE-2024-29994Windows Common Log File System Driver CVE-2024-29996Windows Mobile Broadband CVE-2024-29997Windows Mobile Broadband CVE-2024-29998Windows Mobile Broadband CVE-2024-29999Windows Mobile Broadband CVE-2024-30000Windows Mobile Broadband CVE-2024-30001Windows Mobile Broadband CVE-2024-30002Windows Mobile Broadband CVE-2024-30003Windows Mobile Broadband CVE-2024-30004Windows Mobile Broadband CVE-2024-30005Microsoft WDAC OLE DB provider for SQL CVE-2024-30006Microsoft Brokering File System CVE-2024-30007Windows DWM Core Library CVE-2024-30008Windows Routing and Remote Access Service (RRAS) CVE-2024-30009Windows Hyper-V CVE-2024-30010Windows Hyper-V CVE-2024-30011Windows Mobile Broadband CVE-2024-30012Windows Routing and Remote Access Service (RRA

325
TripleHelix
Moderator
7 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft April 2024 Security Updates (Patch Tuesday)

 This release consists of the following 149 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Windows BitLocker CVE-2024-20665Windows Secure Boot CVE-2024-20669Microsoft Office Outlook CVE-2024-20670Azure Private 5G Core CVE-2024-20685Windows Secure Boot CVE-2024-20688Windows Secure Boot CVE-2024-20689Windows Kernel CVE-2024-20693Microsoft Defender for IoT CVE-2024-21322Microsoft Defender for IoT CVE-2024-21323Microsoft Defender for IoT CVE-2024-21324.NET and Visual Studio CVE-2024-21409Azure Compute Gallery CVE-2024-21424Windows Authentication Methods CVE-2024-21447Microsoft Install Service CVE-2024-26158Windows Secure Boot CVE-2024-26168Windows Secure Boot CVE-2024-26171Windows DWM Core Library CVE-2024-26172Windows Secure Boot CVE-2024-26175Windows Routing and Remote Access Service (RRAS) CVE-2024-26179Windows Secure Boot CVE-2024-26180Windows Kerberos CVE-2024-26183Windows Secure Boot CVE-2024-26189Azure Migrate CVE-2024-26193Windows Secure

9717
TripleHelix
Moderator
7 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft March 2024 Security Updates (Patch Tuesday)

March 2024 Security UpdatesThis release consists of the following 61 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Windows Defender CVE-2024-20671Open Management Infrastructure CVE-2024-21330Open Management Infrastructure CVE-2024-21334Microsoft Authenticator CVE-2024-21390.NET CVE-2024-21392Microsoft Azure Kubernetes Service CVE-2024-21400Role: Windows Hyper-V CVE-2024-21407Role: Windows Hyper-V CVE-2024-21408Skype for Consumer CVE-2024-21411Software for Open Networking in the Cloud (SONiC) CVE-2024-21418Microsoft Dynamics CVE-2024-21419Azure SDK CVE-2024-21421Microsoft Office SharePoint CVE-2024-21426Windows Kerberos CVE-2024-21427Windows USB Hub Driver CVE-2024-21429Windows USB Serial Driver CVE-2024-21430Windows Hypervisor-Protected Code Integrity CVE-2024-21431Windows Update Stack CVE-2024-21432Windows Print Spooler Components CVE-2024-21433Microsoft Windows SCSI Class System File CVE-2024-21434Windows OLE CVE-2024-21435Windows Install

578
TripleHelix
Moderator
8 months ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
published in Vulnerability Vault
Chipmaker Patch Tuesday: Intel, AMD Address New Microarchitectural Vulnerabilities

Intel and AMD publish 10 new security advisories this Patch Tuesday to inform customers about vulnerabilities impacting their products.  March 13, 2024 By Eduard Kovacs Chipmakers Intel and AMD have published 10 new security advisories this Patch Tuesday to inform customers about vulnerabilities impacting their products. Intel published eight new advisories, including two that describe high-severity vulnerabilities. One of the high-severity issues is a local privilege escalation impacting BIOS firmware for some Intel processors. The second is a local privilege escalation that impacts the on-chip debug and test interface in some 4th Generation Intel Xeon processors when using SGX or TDX technology. The remaining nine issues have a ‘medium’ or ‘low’ severity rating. Most of them impact processors and their exploitation could lead to information disclosure, denial of service, and local privilege escalation. >> Full Article <<

40
Jasper_The_Rasper
Moderator
9 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
February 2024 Security Updates This release consists of the following 73 Microsoft CVEs (Patch Tuesday)

February 2024 Security UpdatesThis release consists of the following 73 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?Azure DevOps CVE-2024-20667Microsoft Office CVE-2024-20673Azure Stack CVE-2024-20679Windows Hyper-V CVE-2024-20684Skype for Business CVE-2024-20695Trusted Compute Base CVE-2024-21304Microsoft Defender for Endpoint CVE-2024-21315Microsoft Dynamics CVE-2024-21327Microsoft Dynamics CVE-2024-21328Azure Connected Machine Agent CVE-2024-21329Windows Kernel CVE-2024-21338Windows USB Serial Driver CVE-2024-21339Windows Kernel CVE-2024-21340Windows Kernel CVE-2024-21341Role: DNS Server CVE-2024-21342Windows Internet Connection Sharing (ICS) CVE-2024-21343Windows Internet Connection Sharing (ICS) CVE-2024-21344Windows Kernel CVE-2024-21345Windows Win32K - ICOMP CVE-2024-21346SQL Server CVE-2024-21347Windows Internet Connection Sharing (ICS) CVE-2024-21348Microsoft ActiveX CVE-2024-21349Microsoft WDAC OLE DB provider for SQL CVE-2024-2

5311
TripleHelix
Moderator
9 months ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Chipmaker Patch Tuesday: AMD and Intel Patch Over 100 Vulnerabilities

AMD and Intel patch dozens of vulnerabilities on February 2024 Patch Tuesday, including multiple high-severity bugs. February 14, 2024 By Ionut Arghire Chipmakers AMD and Intel on Tuesday announced patches for a total of over 100 vulnerabilities, including 21 high-severity bugs leading to privilege escalation, code execution, or denial-of-service (DoS).AMD published five advisories detailing vulnerabilities in embedded processors, processors, SEV firmware, and UltraScale and UltraScale+ FPGA series devices.The chipmaker addressed 20 bugs in its embedded processors, including seven high-severity flaws caused by improper parameter handlings, insufficient protections, insufficient checks, improper access controls, and failed validations, which could lead to privilege escalation and arbitrary code execution.AMD also announced patches for four other high-severity vulnerabilities in its processors, which could lead to privilege escalation, DoS, arbitrary code execution, or protection bypass.

60
Jasper_The_Rasper
Moderator
10 months ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Patch Tuesday: Adobe Warns of Critical Flaws in Widely Deployed Software

Adobe ships patches for at least 30 documented security flaws, warning that users are exposed to code execution, security feature bypass and denial-of-service attacks. February 13, 2024 By Ryan Naraine Software maker Adobe on Tuesday released patches for at least 30 documented security flaws in multiple products, warning that users are exposed to code execution, security feature bypass and application denial-of-service attacks.As part of its scheduled Patch Tuesday releases, Adobe called urgent attention to critical flaws in the Adobe Acrobat and Reader, Adobe Commerce and Magento Open Source, Substance 3D Painter, and FrameMaker.Adobe documented at least 13 serious security defects covered in the Adobe Acrobat and Reader update and warned that both Windows and macOS users are at risk.“Successful exploitation could lead to arbitrary code execution, application denial-of-service, and memory leak,” Adobe said.   >> Full Article <<

60
Jasper_The_Rasper
Moderator
10 months ago
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft Patch Tuesday for January 2024

What I’m getting for my Windows 10 Pro! More info to come!   

435
russell.harris
Popular Voice
11 months ago
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Vulnerability Vault
Log4j Aftermath: Lessons Learned and Steps Forward for the Community and IndustryBlog

In the wake of the Log4j vulnerability—arguably one of the most significant security breaches of recent years—the tech world is left grappling with its aftermath. Known as Log4Shell, the Log4j vulnerability had a profound impact due to its ubiquity in enterprise software worldwide. The crux of the issue was its exploitation allowing remote code execution, and with the widespread use of Log4j in various systems, this presented an almost unprecedented level of risk. Now, as the dust settles, it's vital to take a step back and consider what we can learn from this incident and what needs to be done by the community and industry moving forward. The Log4j vulnerability is a stark reminder of the extent of potential security threats in open-source software. The sheer scale of applications and systems using Log4j was immense, and it highlighted how deeply integrated and dependent our technology ecosystem is on such components. Therefore, the first step is acknowledging the scale of potential i

1124
TripleHelix
Moderator
1 year ago

Badges

Show all badges

Join the Conversation

Terms & Conditions