Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-38112 | Windows MSHTML Platform Spoofing Vulnerability Exploited in the Wild (CVE-2024-38112) | 7.5 | 84% | KEV | KEV |
| CVE-2024-43468 | Unauthenticated SQL Injection to RCE in Microsoft Configuration Manager | 9.8 | 81% | KEV | KEV |
| CVE-2024-43488 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution… | 9.8 | 1% | ||
CVE-2024-43573+1 related CVE | Spoofing Vulnerability in Microsoft Windows MSHTML Platform Exploited in the Wild | 8.1 group max | 46% | KEV | KEV |
| CVE-2024-43582 | Remote Desktop Protocol Server Remote Code Execution Vulnerability | 8.1 | 3% |
From the original article
2 min read at helpnetsecurity.com
For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console (MMC).
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.