Microsoft has released security updates for 60 vulnerabilities in its March 2024 Patch Tuesday rollout. There are two Critical vulnerabilities patched (CVE-2024-21407 and CVE-2024-21408), both of which affect the Hyper-V hypervisor. March 2024 Risk Analysis This month’s leading risk type is elevation of privilege (40%) followed by remote code execution (30%) and a tie between … [Read more...] about March 2024 Patch Tuesday: Updates and Analysis
patch
February 2024 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 73 vulnerabilities for its February 2024 Patch Tuesday rollout. These include two actively exploited zero-days (CVE-2024-21412 and CVE-2024-21351), both of which are security feature bypass flaws. Five of the vulnerabilities addressed today are rated Critical while the remaining 68 are rated Important or Moderate. February 2024 Risk … [Read more...] about February 2024 Patch Tuesday: Updates and Analysis
November Patch Tuesday 2023: Updates and Analysis
Microsoft has released security updates for 58 vulnerabilities, including five zero-days, three of which are being actively exploited. One of the zero-days (CVE-2023-36025) is a Windows SmartScreen Security Feature Bypass Vulnerability, the second (CVE-2023-36033) is a privilege escalation vulnerability in the Windows DWM Core Library, and the third (CVE-2023-36036) is another … [Read more...] about November Patch Tuesday 2023: Updates and Analysis
October 2023 Patch Tuesday: Updates and Analysis
This month marks the 20th anniversary of Patch Tuesday, and Microsoft has released security updates for 104 vulnerabilities, including three zero-days. One of the zero-days (CVE-2023-41763) is an elevation of privilege vulnerability in Microsoft Skype for Business. The second (CVE-2023-36563) is an information disclosure vulnerability in Microsoft WordPad, and the third … [Read more...] about October 2023 Patch Tuesday: Updates and Analysis
Cisco Releases Urgent Patch to Fix Critical Flaw in Emergency Responder Systems
Oct 05, 2023NewsroomNetwork Security / Software Patch Cisco has released updates to address a critical security flaw impacting Emergency Responder that allows unauthenticated, remote attackers to sign into susceptible systems using hard-coded credentials. The vulnerability, tracked as CVE-2023-20101 (CVSS score: 9.8), is due to the presence of static user credentials for the … [Read more...] about Cisco Releases Urgent Patch to Fix Critical Flaw in Emergency Responder Systems
August 2023 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 76 vulnerabilities and two zero-days for its August 2023 Patch Tuesday rollout. One of the zero-days (CVE-2023-38180) is a denial-of-service vulnerability in .NET and Visual Studio. The other zero-day (CVE-2023-36884) received a Defense in Depth update to mitigate a flaw under active attack; however, it is not a patch. Six of the … [Read more...] about August 2023 Patch Tuesday: Updates and Analysis
July 2023 Patch Tuesday: Updates and Analysis
Microsoft has released security updates for 131 vulnerabilities and a disclosure for one yet-unpatched vulnerability for its July 2023 Patch Tuesday rollout: 9 are rated as Critical while the remaining 122 are rated as Important. There is one vulnerability without a severity rating. July 2023 Risk Analysis This month’s leading risk type is remote code execution (28%), followed … [Read more...] about July 2023 Patch Tuesday: Updates and Analysis
June Patch Tuesday 2023: Updates and Analysis
Microsoft has released 78 security patches for its June 2023 Patch Tuesday rollout. Of the vulnerabilities patched today, 6 are classified as Critical and 38 are remote code execution (RCE) flaws. June 2023 Risk Analysis This month’s leading risk type is remote code execution (41%), followed by elevation of privilege at nearly 22% and a tie for denial of service and spoofing … [Read more...] about June Patch Tuesday 2023: Updates and Analysis
Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability
Jun 06, 2023Ravie LakshmananBrowser Security / Vulnerability Google on Monday released security updates to patch a high-severity flaw in its Chrome web browser that it said is being actively exploited in the wild. Tracked as CVE-2023-3079, the vulnerability has been described as a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google's Threat Analysis … [Read more...] about Zero-Day Alert: Google Issues Patch for New Chrome Vulnerability
Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products
Apr 21, 2023Ravie LakshmananSoftware Update / Network Security Cisco and VMware have released security updates to address critical security flaws in their products that could be exploited by malicious actors to execute arbitrary code on affected systems. The most severe of the vulnerabilities is a command injection flaw in Cisco Industrial Network Director (CVE-2023-20036, … [Read more...] about Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products