Microsoft Tuesday fixed 90 flaws, including 10 zero days

Microsoft on Tuesday fixed a total of 90 security flaws, including 10 zero-days, of which six have come under active exploitation in the wild.

Of the 90 bugs, seven are rated Critical, 79 are rated Important, and one is rated Moderate in severity. This is also in addition to 36 vulnerabilities that the tech giant resolved in its Edge browser since last month.

• Cyber Attack

Joint cybersecurity advisory
Botnet infects 260,000 SOHO routers, IP cameras with malware

By infosecbulletin / Wednesday , September 18 2024

The FBI has alerted that cyber actors have compromised over 260,000 internet-connected devices, mainly routers, to form a large botnet...

Read More

• Alert
• Vulnerabilities

Chrome 129 Released Fix with multiple Security Flaws

By infosecbulletin / Wednesday , September 18 2024

Google has released Chrome 129 for Windows, Mac, and Linux users. The update will be available gradually over the next...

Read More

• Cyber Attack
• Vulnerabilities

Broadcom fixed RCE bug in VMware vCenter Server

By infosecbulletin / Wednesday , September 18 2024

Broadcom has fixed a serious VMware vCenter Server vulnerability that allows attackers to execute remote code on unpatched servers through...

Read More

• Cyber Attack
• Vulnerabilities

Cybercriminal now misuse Microsoft Azure tool to steal data

By infosecbulletin / Wednesday , September 18 2024

Ransomware groups like BianLian and Rhysida use Microsoft's Azure Storage Explorer and AzCopy to steal data from hacked networks and...

Read More

• Vulnerabilities

Apple warns users to install iOS 18 to Fix 33 iPhone Vulnerabilities

By infosecbulletin / Tuesday , September 17 2024

Apple has released iOS 18, the latest update for iPhones and iPads. Along with new features, it mainly focuses on...

Read More

• Alert

CISA adds windows and whatsUp Gold vuls to its KEV

By infosecbulletin / Tuesday , September 17 2024

CISA has warned Microsoft Windows MSHTML Platform Spoofing Vulnerability and Progress WhatsUp Gold SQL Injection Vulnerability actively exploited security flaws,...

Read More

• Data Breach

Petroleum and Fuel Industry
FleetPanda exposes Nearly One Million Documents

By infosecbulletin / Tuesday , September 17 2024

Cybersecurity researcher Jeremiah Fowler found a non-password-protected database with 780,000 records from FleetPanda, a tech provider for dispatch management. The...

Read More

• Cyber Attack

DESCO faces cyber attack: Customers Data Breach

By infosecbulletin / Tuesday , September 17 2024

A recent dark web scan revealed that customer data from Dhaka Electric Supply Company Limited (DESCO) has been exposed. The...

Read More

• Cyber Attack
• Vulnerabilities

Alert! Google Fixes GCP Composer Flaw

By infosecbulletin / Monday , September 16 2024

Tenable Research found and fixed a remote code execution (RCE) vulnerability, called CloudImposer, in Google Cloud Platform (GCP). This flaw...

Read More

• National

CTF in Bangladesh: Unveiling Challenges, Opportunities and remedies

By infosecbulletin / Sunday , September 15 2024

In this article, we won’t dive too deep into the technical aspects of Capture The Flag (CTF) competitions. Instead, we...

Read More

The Patch Tuesday updates are notable for addressing six actively exploited zero-days :

CVE-2024-38189 (CVSS score: 8.8) – Microsoft Project Remote Code Execution Vulnerability

CVE-2024-38178 (CVSS score: 7.5) – Windows Scripting Engine Memory Corruption Vulnerability

CVE-2024-38193 (CVSS score: 7.8) – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2024-38106 (CVSS score: 7.0) – Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-38107 (CVSS score: 7.8) – Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

CVE-2024-38213 (CVSS score: 6.5) – Windows Mark of the Web Security Feature Bypass Vulnerability

CVE-2024-38213, which allows attackers to bypass SmartScreen protections, requires an attacker to send the user a malicious file and convince them to open it. Credited with discovering and reporting the flaw is Trend Micro’s Peter Girnus, suggesting that it could be a bypass for CVE-2024-21412 or CVE-2023-36025, which were previously exploited by DarkGate malware operators.