Microsoft Patch Tuesday — August 2018
Tuesday, 14 August 2018
- Vulnerabilities
- 60
- Critical
- 0
- High
- 14
- Zero-days
- 0
- Public exploit
- 6
Exploited 4
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 8.8
CVE-2018-8414 Exploited Public exploit A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerabili…EPSS 73%
-
High 7.8
CVE-2018-8405 Exploited An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 3.4%
-
High 7.8
CVE-2018-8406 Exploited An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 3.4%
-
High 7.5
CVE-2018-8373 Exploited A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 62%
Public exploit code 5
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 68%
- High 7.5 EPSS 64%
-
Unscored
CVE-2018-0952 Public exploit An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hub Standar…EPSS 6.2%
-
Unscored
CVE-2018-8353 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 67%
-
Unscored
CVE-2018-8389 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 30%
All vulnerabilities 60
High14 ShowHide
-
High 8.8
CVE-2018-8414 Exploited Public exploit A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerabili…EPSS 73%
-
High 7.8
CVE-2018-8405 Exploited An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 3.4%
-
High 7.8
CVE-2018-8406 Exploited An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 3.4%
-
High 7.5
CVE-2018-8373 Exploited A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 62%
- High 7.5 EPSS 68%
- High 7.5 EPSS 64%
- High 7.5 EPSS 29%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 26%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
Unscored46 ShowHide
-
Unscored
CVE-2018-0952 Public exploit An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hub Standar…EPSS 6.2%
-
Unscored
CVE-2018-8353 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 67%
-
Unscored
CVE-2018-8389 Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 30%
-
Unscored
CVE-2018-8200 A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "De…EPSS 1.5%
-
Unscored
CVE-2018-8204 A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "De…EPSS 1.5%
-
Unscored
CVE-2018-8253 An elevation of privilege vulnerability exists when Microsoft Cortana allows arbitrary website browsing on the lockscreen, aka "Microsoft Cortana Elevation of …EPSS 1.9%
-
Unscored
CVE-2018-8273 A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Microsoft SQL Server Remo…EPSS 31%
-
Unscored
CVE-2018-8302 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchan…EPSS 27%
-
Unscored
CVE-2018-8316 A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries, aka "Internet Explorer…EPSS 14%
-
Unscored
CVE-2018-8339 An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr…EPSS 1.2%
-
Unscored
CVE-2018-8340 A security feature bypass vulnerability exists when Active Directory Federation Services (AD FS) improperly handles multi-factor authentication requests, aka "…EPSS 7.9%
-
Unscored
CVE-2018-8341 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.9%
-
Unscored
CVE-2018-8342 An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior t…EPSS 1.3%
-
Unscored
CVE-2018-8343 An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior t…EPSS 1.3%
-
Unscored
CVE-2018-8344 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 23%
-
Unscored
CVE-2018-8345 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Exec…EPSS 15%
-
Unscored
CVE-2018-8346 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Exec…EPSS 20%
-
Unscored
CVE-2018-8347 An elevation of privilege vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle parsing of certain symbolic links, aka "Wi…EPSS 1.4%
-
Unscored
CVE-2018-8348 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.4%
-
Unscored
CVE-2018-8349 A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…EPSS 23%
-
Unscored
CVE-2018-8350 A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory, aka "Windows PDF Remote Code Execution Vu…EPSS 20%
-
Unscored
CVE-2018-8351 An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft Browser Information Di…EPSS 8.4%
-
Unscored
CVE-2018-8357 An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Vulnerability." Thi…EPSS 8.3%
-
Unscored
CVE-2018-8358 A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests, aka "Microsoft Edge Security Feature Bypass Vulnerabil…EPSS 5.8%
-
Unscored
CVE-2018-8360 An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka…EPSS 9.6%
-
Unscored
CVE-2018-8370 A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability…EPSS 4.9%
-
Unscored
CVE-2018-8374 A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability."…EPSS 3.3%
-
Unscored
CVE-2018-8375 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 17%
-
Unscored
CVE-2018-8376 A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft Powe…EPSS 19%
-
Unscored
CVE-2018-8377 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 10%
-
Unscored
CVE-2018-8378 An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose …EPSS 7.3%
-
Unscored
CVE-2018-8379 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 18%
-
Unscored
CVE-2018-8382 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur…EPSS 13%
-
Unscored
CVE-2018-8383 A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft E…EPSS 7.6%
-
Unscored
CVE-2018-8387 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 10%
-
Unscored
CVE-2018-8388 A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso…EPSS 3.9%
-
Unscored
CVE-2018-8394 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 8.5%
-
Unscored
CVE-2018-8396 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 2.6%
-
Unscored
CVE-2018-8397 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code E…EPSS 68%
-
Unscored
CVE-2018-8398 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 8.5%
-
Unscored
CVE-2018-8399 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2018-8400 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 2.1%
-
Unscored
CVE-2018-8401 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 2.1%
-
Unscored
CVE-2018-8403 A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerabilit…EPSS 13%
-
Unscored
CVE-2018-8404 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2018-8412 An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka …EPSS 1.4%