September 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2019-0787+3 related CVEs | A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote… | 8.8 | 12% | ||
| CVE-2019-11184 | A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial… | 4.8 | <1% | ||
CVE-2019-1181+1 related CVE | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to… | 9.8 | 76% | ||
CVE-2019-1215+1 related CVE | Local Privilege Escalation in Microsoft Windows Winsock Driver (ws2ifsl.sys) | 7.8 | 19% | KEVRansomware | KEV |
CVE-2019-1257+2 related CVEs | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka… | 8.8 | 12% | ||
| CVE-2019-1306 | A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps… | 9.8 | 17% |
From the original article
3 min read at helpnetsecurity.com
For the September 2019 Patch Tuesday, Microsoft delivered fixes for 80 CVE-numbered security issues (including to actively exploited zero-days), Adobe fixed flaws in Flash Player and Application Manager, and Intel offered solutions and mitigations for two security holes, one of which could allow a side-channel attack aimed at acquiring sensitive data (e. g. , keystrokes in a SSH session).
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.