Microsoft disclosed 48 vulnerabilities in its products and services in 2024. 46 of them are considered “important” severity.
A critical security vulnerability, known as CVE-2024-20674, was fixed on Tuesday. This vulnerability affects the Windows Kerberos authentication protocol. By carrying out a man-in-the-middle attack, an attacker could exploit this vulnerability to pretend to be the Kerberos authentication server and bypass the authentication process.
By infosecbulletin
/ Thursday , September 19 2024
GitLab released patches for a critical flaw in Community and Enterprise Editions that could allow authentication bypass. The vulnerability in...
Read More
By infosecbulletin
/ Thursday , September 19 2024
On September 16, 2024, Globe Pharmaceuticals Ltd., a major pharmaceutical company in Bangladesh, was hit by a ransomware attack detected...
Read More
By infosecbulletin
/ Wednesday , September 18 2024
The FBI has alerted that cyber actors have compromised over 260,000 internet-connected devices, mainly routers, to form a large botnet...
Read More
By infosecbulletin
/ Wednesday , September 18 2024
Google has released Chrome 129 for Windows, Mac, and Linux users. The update will be available gradually over the next...
Read More
By infosecbulletin
/ Wednesday , September 18 2024
Broadcom has fixed a serious VMware vCenter Server vulnerability that allows attackers to execute remote code on unpatched servers through...
Read More
By infosecbulletin
/ Wednesday , September 18 2024
Ransomware groups like BianLian and Rhysida use Microsoft's Azure Storage Explorer and AzCopy to steal data from hacked networks and...
Read More
By infosecbulletin
/ Tuesday , September 17 2024
Apple has released iOS 18, the latest update for iPhones and iPads. Along with new features, it mainly focuses on...
Read More
By infosecbulletin
/ Tuesday , September 17 2024
CISA has warned Microsoft Windows MSHTML Platform Spoofing Vulnerability and Progress WhatsUp Gold SQL Injection Vulnerability actively exploited security flaws,...
Read More
By infosecbulletin
/ Tuesday , September 17 2024
Cybersecurity researcher Jeremiah Fowler found a non-password-protected database with 780,000 records from FleetPanda, a tech provider for dispatch management. The...
Read More
By infosecbulletin
/ Tuesday , September 17 2024
A recent dark web scan revealed that customer data from Dhaka Electric Supply Company Limited (DESCO) has been exposed. The...
Read More
Microsoft believes that the vulnerability is more likely to be exploited because Keberos is present on many popular operating systems.
Another important issue is CVE-2024-20700, which allows for remote code execution in Windows Hyper-V. An attacker needs to win a race condition and gain access to a restricted network for the exploit to work.
Two more remote code execution vulnerabilities are important: CVE-2024-21307 in Windows Remote Desktop Client and CVE-2024-21318 in SharePoint Server.
CVE-2024-21307 is a vulnerability that can be exploited when an authenticated user connects to a malicious remote desktop server. The server sends a specially designed Server RDP Preconnection that targets the remote client’s drive redirection virtual channel. This can result in remote code execution on the victim’s machine.
CVE-2024-21318 can be exploited by attackers with relative ease. They only need to write and inject specific code to SharePoint Server.
The Windows Kernel has a vulnerability called CVE-2024-20698, which allows an attacker to gain SYSTEM privileges. There are no details on how the attacker can exploit this vulnerability.
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.