exploit

Microsoft's Patch Tuesday on March 11, 2025, introduced a routine selection of security patches, as is customary with the monthly update cycle. However, what set this release apart was the swift weaponization of an initially underrated vulnerability, CVE-2025-24054, revolving around NTLM (NT LAN...

Microsoft's March 2025 Patch Tuesday brought an extensive lineup of bug fixes, but among these was a vulnerability that would quickly escalate into a significant security incident: CVE-2025-24054, an NTLM hash-leaking flaw. While Microsoft initially considered this vulnerability "less likely" to...

When Microsoft stamped its latest security vulnerability as low risk, they probably didn’t expect hackers to treat it like Black Friday at a bug bazaar. Turning "Low Risk" into Worldwide Mayhem: The Unlikely Rise of CVE-2025-24054 On March 11—just another Patch Tuesday in corporate IT...

A critical vulnerability has emerged that could reshape how we view the security of our trusted productivity tools. CVE-2025-29820 is a use-after-free flaw found in Microsoft Office Word—a flaw that enables an attacker, with local access or via tricking a user into opening a malicious document...

In today’s interconnected world where remote management is critical, a newly identified vulnerability—CVE-2025-26671—has raised serious concerns among IT professionals. This use-after-free flaw in Windows Remote Desktop Services (RDS) can allow an unauthorized attacker to execute arbitrary code...

EternalBlue is not just another exploit in the cybersecurity hall of fame—it’s the infamous flaw that shook the digital world in 2017 and still resonates in security advisories today. Originally leaked by the hacker group The Shadow Brokers, this exploit was reportedly developed by the U.S...

The recent discovery of an exploit bypassing Windows Defender Application Control (WDAC) underscores the ever-evolving ingenuity of adversaries and the persistent challenges facing enterprise security. Researchers have revealed how sophisticated attackers can now leverage a JavaScript-based...

Windows users, patch up and be on high alert—a critical Windows vulnerability has been exposed with a Proof of Concept (PoC) exploit already making waves in the cybersecurity community. Known as CVE-2024-43641, this Elevation of Privilege vulnerability has the potential to let attackers run...

As the leaves turn and November ushers in the chill of winter, Microsoft is heating things up with a substantial software patch that you don’t want to overlook. On November 12, 2024, Redmond unleashed its monthly Patch Tuesday update, delivering fixes for a whopping 89 vulnerabilities, among...

The recent identification of CVE-2024-7971, a security vulnerability classified as "Type Confusion in V8," has raised significant concerns within the tech community, especially for users of Microsoft Edge, which is based on Chromium. In this article, we will delve into the nature of this...

On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully...

🤔

Original release date: September 22, 2021 Summary Immediate Actions You Can Take Now to Protect Against Conti Ransomware • Use Link Removed. • Segment and segregate networks and functions. • Update your operating system and software. Note: This Alert uses the MITRE Adversarial Tactics...

Original release date: September 16, 2021 Summary This Joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 8. See the ATT&CK for Enterprise for referenced threat actor tactics and for techniques. This joint advisory is...

In brief: It seems that gaining administrator-level Windows privileges on a PC doesn't require much work; all you need is physical access and a Razer mouse or keyboard. It's the result of a zero-day vulnerability in the company's popular Synapse software that exploits the plug-and-play...

:eek:

:eek:

:rolleyes:

Original release date: April 20, 2021 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises affecting U.S. government agencies, critical infrastructure entities, and other private sector organizations by a cyber threat actor—or actors—beginning in June 2020...

Pretty significant vulnerability that Microsoft is patching even for out of support versions of Windows. For the out of support the update is available only through the Windows Update Catalog. Microsoft Update Catalog TechNet Blog about the vulnerability and direct links to the patch download...