Vulnerabilitycritical
Microsoft Tuesday August 2018
- CVEs
- CVE-2018-8273CVE-2018-8302CVE-2018-8344CVE-2018-8350CVE-2018-8266CVE-2018-8355CVE-2018-8380CVE-2018-8381CVE-2018-8384CVE-2018-8397CVE-2018-8345CVE-2018-8359CVE-2018-8371CVE-2018-8372CVE-2018-8373CVE-2018-8377CVE-2018-8385CVE-2018-8387CVE-2018-8390CVE-2018-8403CVE-2018-8200CVE-2018-8340CVE-2018-0952CVE-2018-8204CVE-2018-8253CVE-2018-8316CVE-2018-8339CVE-2018-8341CVE-2018-8342CVE-2018-8343CVE-2018-8346CVE-2018-8347CVE-2018-8348CVE-2018-8349CVE-2018-8351CVE-2018-8353CVE-2018-8357CVE-2018-8358CVE-2018-8360CVE-2018-8370CVE-2018-8375CVE-2018-8376CVE-2018-8378CVE-2018-8379CVE-2018-8382CVE-2018-8383CVE-2018-8389CVE-2018-8394CVE-2018-8396CVE-2018-8398CVE-2018-8399CVE-2018-8400
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0952 | An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hub… | 7.8 | 6% | PoC | |
| CVE-2018-8349 | A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows… | 8.8 group max | 23% | ||
| CVE-2018-8384 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting… | 7.5 | 62% | ||
| CVE-2018-8273 | A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Microsoft SQL Server… | 9.8 | 29% | ||
| CVE-2018-8302 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft… | 9.8 | 26% | ||
| CVE-2018-8357 | An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Vulnerability."… | 8.3 group max | 8% | ||
| CVE-2018-8340 | A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka… | 6.5 | 8% | ||
CVE-2018-8397+3 related CVEs | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code… | 8.8 group max | 68% | ||
CVE-2018-8377+4 related CVEs | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability."… | 7.5 group max | 10% | ||
| CVE-2018-8360 | An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka… | 7.5 | 9% | ||
| CVE-2018-8373 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.5 | 62% | KEV | KEV |
CVE-2018-8379+2 related CVEs | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel… | 7.8 group max | 17% | ||
| CVE-2018-8376 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft… | 8.8 | 18% | ||
| CVE-2018-8378 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose… | 5.5 | 8% |
From the original article
5 min read at blog.talosintelligence.com
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 62 new vulnerabilities, 20 of which are rated “critical,” 38 that are rated “important,” one that is rated moderate and one that is rated as low severity.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.