August 2018 Patch Tuesday: Microsoft fixes two actively exploited zero-days
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
| CVE-2018-8340 | A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka… | 6.5 | 8% | ||
| CVE-2018-8345 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code… | 7.5 | 14% | ||
| CVE-2018-8373 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.5 | 62% | KEV | KEV |
| CVE-2018-8414 | File Path Validation RCE in Microsoft Windows Shell (Windows 10 and Server 1703–1803) | 8.8 | 73% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
In the August 2018 Patch Tuesday, Microsoft has plugged over 60 vulnerabilities, two of which are being actively exploited in the wild. In addition to those, the company has also released a critical update advisory that addresses vulnerabilities found and patched in Adobe Flash.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.