Microsoft Patch Tuesday — July 2018
Tuesday, 10 July 2018
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
- High 7.5 EPSS 75%
Critical 1
- Critical 9.8 EPSS 7.7%
Public exploit code 5
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 69%
- High 7.5 EPSS 69%
-
Unscored
CVE-2018-8279 Public exploit A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 71%
-
Unscored
CVE-2018-8172 Public exploit A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka…EPSS 33%
-
Unscored
CVE-2018-8284 Public exploit A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln…EPSS 46%
All vulnerabilities 53
Critical1 ShowHide
- Critical 9.8 EPSS 7.7%
High10 ShowHide
- High 7.5 EPSS 75%
- High 7.5 EPSS 69%
- High 7.5 EPSS 69%
-
High 7.5
CVE-2018-8171 Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validatedEPSS 11%
- High 7.5 EPSS 21%
- High 7.5 EPSS 15%
- High 7.5 EPSS 21%
- High 7.5 EPSS 16%
- High 7.5 EPSS 21%
- High 7.5 EPSS 21%
Medium2 ShowHide
- Medium 6.5 EPSS 5.8%
- Medium 5.5
Unscored40 ShowHide
-
Unscored
CVE-2018-8279 Public exploit A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 71%
-
Unscored
CVE-2018-8172 Public exploit A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka…EPSS 33%
-
Unscored
CVE-2018-8284 Public exploit A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln…EPSS 46%
-
Unscored
CVE-2018-0949 A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "Internet Explorer Sec…EPSS 12%
-
Unscored
CVE-2018-8125 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 20%
-
Unscored
CVE-2018-8202 An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level, aka ".NET Framework Elevation …EPSS 1.3%
-
Unscored
CVE-2018-8206 A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server Denial of Service Vu…EPSS 12%
-
Unscored
CVE-2018-8222 A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "De…EPSS 2.1%
-
Unscored
CVE-2018-8232 A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering Vulnerability." This affect…EPSS 1.2%
-
Unscored
CVE-2018-8238 A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Busines…EPSS 6%
-
Unscored
CVE-2018-8242 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 19%
-
Unscored
CVE-2018-8260 A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framework Remote Code Exe…EPSS 16%
-
Unscored
CVE-2018-8262 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 21%
-
Unscored
CVE-2018-8274 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 21%
-
Unscored
CVE-2018-8275 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 21%
-
Unscored
CVE-2018-8278 A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso…EPSS 7.1%
-
Unscored
CVE-2018-8281 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 21%
-
Unscored
CVE-2018-8282 An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation…EPSS 1.3%
-
Unscored
CVE-2018-8289 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 10%
-
Unscored
CVE-2018-8296 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 17%
-
Unscored
CVE-2018-8297 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 10%
-
Unscored
CVE-2018-8299 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.5%
-
Unscored
CVE-2018-8300 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka "Microso…EPSS 14%
-
Unscored
CVE-2018-8301 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 14%
-
Unscored
CVE-2018-8304 A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Den…EPSS 13%
-
Unscored
CVE-2018-8305 An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability."…EPSS 8.6%
-
Unscored
CVE-2018-8306 A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage …EPSS 3.1%
-
Unscored
CVE-2018-8307 A security feature bypass vulnerability exists when Microsoft WordPad improperly handles embedded OLE objects, aka "WordPad Security Feature Bypass Vulnerabili…EPSS 3.8%
-
Unscored
CVE-2018-8308 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege V…EPSS 3.9%
-
Unscored
CVE-2018-8309 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows…EPSS 1.7%
-
Unscored
CVE-2018-8310 A tampering vulnerability exists when Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails, aka "Microsoft Office Ta…EPSS 5.9%
-
Unscored
CVE-2018-8311 A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remot…EPSS 17%
-
Unscored
CVE-2018-8312 A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote Code Execution Vuln…EPSS 21%
-
Unscored
CVE-2018-8313 An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."…EPSS 1.3%
-
Unscored
CVE-2018-8314 An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This …EPSS 4.2%
-
Unscored
CVE-2018-8323 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.5%
-
Unscored
CVE-2018-8324 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 10%
-
Unscored
CVE-2018-8325 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 6.3%
-
Unscored
CVE-2018-8326 A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properl…EPSS 2.6%
-
Unscored
CVE-2018-8327 A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerability." This affects …EPSS 23%