Security

Welcome to the first Patch Tuesday of 2024! We are starting a New Year with 49 new bugs where only 2 are critical. As the article will be really short this time, let’s briefly review these bugs! CVE-2024-20674 – Windows Kerberos Security Feature Bypass Vulnerability The first one one our list is a Critical bug […]

This month, Microsoft released patches addressing 78 CVEs, including 3 zero-days + 2 publicly disclosed and 3 criticals. Let’s briefly review them! CVE-2023-36025 – Windows SmartScreen Security Feature Bypass Vulnerability The first zero-day looks more like a bypass than a privilege escalation. An attacker can bypass Windows Defender SmartScreen checks and other prompts. This bug

For October, Microsoft released patches for 103 CVEs, including 3 zero-days and 13 criticals. Let’s briefly review them! CVE-2023-44487 – HTTP/2 Rapid Reset Attack The first zero-day was reported as being under active attack across Google systems in August 2023, but Microsoft released a patch for their products right now. This vulnerability allows attackers to

This month the Patching Tuesday brings us 59 new CVEs including 2 zero-days and 5 criticals. Look like a common month? Let’s check! CVE-2023-36761 – Microsoft Word Information Disclosure Vulnerability This critical bug in Word comes first. Microsoft classified that as an information disclosure vulnerability, but… this one allows the disclosure of NTLM hashes, presumably

This month, Microsoft has fixed 130 vulnerabilities, including 5 zero-days + 9 criticals. It’s more than the last two months, so let’s briefly review them, because patching is waiting 🙂 CVE-2023-36884 – Office and Windows HTML Remote Code Execution Vulnerability We starting with the most important CVE this month, at least in my opinion. Microsoft

This month, Microsoft has fixed 38 vulnerabilities, including 3 zero-days and 5 other critical ones. Let’s briefly review them! CVE-2023-29336 – Win32k Elevation of Privilege Vulnerability The first CVE is exploited in the wild. As usual, we don’t have detailed information about the vulnerability, only we know that the attacker can elevate to the SYSTEM