Microsoft Patch Tuesday — May 2018
Tuesday, 8 May 2018
- Vulnerabilities
- 65
- Critical
- 0
- High
- 15
- Zero-days
- 0
- Public exploit
- 10
Exploited 3
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 7.5
CVE-2018-0824 Exploited Public exploit A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…EPSS 73%
-
High 7.5
CVE-2018-8174 Exploited Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 88%
-
High 7.0
CVE-2018-8120 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 73%
Public exploit code 7
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 51%
- High 7.5 EPSS 50%
- High 7.5 EPSS 66%
- High 7.5 EPSS 67%
-
Unscored
CVE-2018-0953 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor…EPSS 66%
-
Unscored
CVE-2018-8134 Public exploit An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."…EPSS 2.9%
-
Unscored
CVE-2018-0959 Public exploit A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 9.8%
All vulnerabilities 65
High15 ShowHide
-
High 7.5
CVE-2018-0824 Exploited Public exploit A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…EPSS 73%
-
High 7.5
CVE-2018-8174 Exploited Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 88%
-
High 7.0
CVE-2018-8120 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 73%
- High 7.5 EPSS 51%
- High 7.5 EPSS 50%
- High 7.5 EPSS 66%
- High 7.5 EPSS 67%
-
High 7.5
CVE-2018-0765 Denial of service vulnerability exists when .NET and .NET Core improperly process XML documentsEPSS 8.1%
- High 7.5 EPSS 16%
- High 7.5 EPSS 16%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 16%
- High 7.5 EPSS 16%
- High 7.5 EPSS 11%
Unscored50 ShowHide
-
Unscored
CVE-2018-0953 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor…EPSS 66%
-
Unscored
CVE-2018-8134 Public exploit An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."…EPSS 2.9%
-
Unscored
CVE-2018-0959 Public exploit A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 9.8%
-
Unscored
CVE-2018-0854 A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard, aka "Windows Security Feature By…EPSS 1.5%
-
Unscored
CVE-2018-0951 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor…EPSS 16%
-
Unscored
CVE-2018-0955 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 16%
-
Unscored
CVE-2018-0958 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil…EPSS 1.4%
-
Unscored
CVE-2018-0961 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data, aka "Hyper-V vSMB Remote Code E…EPSS 3.1%
-
Unscored
CVE-2018-1021 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 6.1%
-
Unscored
CVE-2018-1025 An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka "Microsoft Browser Information Disclos…EPSS 6.1%
-
Unscored
CVE-2018-1039 A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard, aka ".NET Framework Device Guard Securit…EPSS 1.3%
-
Unscored
CVE-2018-8112 A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas…EPSS 2.8%
-
Unscored
CVE-2018-8114 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 16%
-
Unscored
CVE-2018-8119 A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Az…EPSS 1.2%
-
Unscored
CVE-2018-8122 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 16%
-
Unscored
CVE-2018-8123 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 6%
-
Unscored
CVE-2018-8124 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2018-8126 A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies, aka "Internet Explorer Securi…EPSS 5.5%
-
Unscored
CVE-2018-8127 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.9%
-
Unscored
CVE-2018-8128 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor…EPSS 16%
-
Unscored
CVE-2018-8129 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil…EPSS 1.4%
-
Unscored
CVE-2018-8132 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Feature Bypass Vulnerabil…EPSS 1.4%
-
Unscored
CVE-2018-8136 A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects…EPSS 23%
-
Unscored
CVE-2018-8141 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.5%
-
Unscored
CVE-2018-8147 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 24%
-
Unscored
CVE-2018-8148 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 24%
-
Unscored
CVE-2018-8149 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.8%
-
Unscored
CVE-2018-8150 A security feature bypass vulnerability exists when the Microsoft Outlook attachment block filter does not properly handle attachments, aka "Microsoft Outlook …EPSS 5.3%
-
Unscored
CVE-2018-8151 An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerab…EPSS 8.7%
-
Unscored
CVE-2018-8152 An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange …EPSS 3.5%
-
Unscored
CVE-2018-8153 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoof…EPSS 3.4%
-
Unscored
CVE-2018-8154 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchan…EPSS 24%
-
Unscored
CVE-2018-8155 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.8%
-
Unscored
CVE-2018-8156 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.8%
-
Unscored
CVE-2018-8157 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 24%
-
Unscored
CVE-2018-8158 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 24%
-
Unscored
CVE-2018-8159 An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange …EPSS 3.5%
-
Unscored
CVE-2018-8160 An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects …EPSS 8.5%
-
Unscored
CVE-2018-8161 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 21%
-
Unscored
CVE-2018-8162 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 24%
-
Unscored
CVE-2018-8163 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur…EPSS 13%
-
Unscored
CVE-2018-8164 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.5%
-
Unscored
CVE-2018-8165 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 1.3%
-
Unscored
CVE-2018-8166 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2018-8167 An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka "Windows Common …EPSS 1%
-
Unscored
CVE-2018-8168 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.5%
-
Unscored
CVE-2018-8170 An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory, aka "Windows Image Elevation of Privilege Vu…EPSS 1%
-
Unscored
CVE-2018-8173 A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote…EPSS 20%
-
Unscored
CVE-2018-8178 A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerabilit…EPSS 15%
-
Unscored
CVE-2018-8179 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 14%