Microsoft Patch Tuesday — September 2018
Tuesday, 11 September 2018
- Vulnerabilities
- 62
- Critical
- 0
- High
- 11
- Zero-days
- 0
- Public exploit
- 11
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 7.8
CVE-2018-8440 Exploited Public exploit An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr…EPSS 19%
Public exploit code 10
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 27%
- High 7.5 EPSS 69%
- High 7.5 EPSS 69%
-
Unscored
CVE-2018-8410 Public exploit An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows Registry Elevation of Pr…EPSS 4%
-
Unscored
CVE-2018-8449 Public exploit A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe…EPSS 3.1%
-
Unscored
CVE-2018-8463 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr…EPSS 15%
-
Unscored
CVE-2018-8468 Public exploit An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This affects Window…EPSS 12%
-
Unscored
CVE-2018-8469 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr…EPSS 15%
-
Unscored
CVE-2018-8474 Public exploit A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Fe…EPSS 38%
-
Unscored
CVE-2018-8420 Public exploit A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab…EPSS 49%
All vulnerabilities 62
High11 ShowHide
-
High 7.8
CVE-2018-8440 Exploited Public exploit An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr…EPSS 19%
- High 7.5 EPSS 27%
- High 7.5 EPSS 69%
- High 7.5 EPSS 69%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 11%
-
High 7.5
CVE-2018-8409 Denial of service vulnerability exists when System.IO.Pipelines improperly handles requestsEPSS 6.6%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
Medium2 ShowHide
- Medium 4.3 EPSS 5.6%
- Medium 4.2 EPSS 3.2%
Unscored49 ShowHide
-
Unscored
CVE-2018-8410 Public exploit An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows Registry Elevation of Pr…EPSS 4%
-
Unscored
CVE-2018-8449 Public exploit A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe…EPSS 3.1%
-
Unscored
CVE-2018-8463 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr…EPSS 15%
-
Unscored
CVE-2018-8468 Public exploit An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This affects Window…EPSS 12%
-
Unscored
CVE-2018-8469 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr…EPSS 15%
-
Unscored
CVE-2018-8474 Public exploit A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Fe…EPSS 38%
-
Unscored
CVE-2018-8420 Public exploit A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab…EPSS 49%
-
Unscored
CVE-2018-0965 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 5.1%
-
Unscored
CVE-2018-8271 An information disclosure vulnerability exists in Windows when the Windows bowser.sys kernel-mode driver fails to properly handle objects in memory, aka "Windo…EPSS 2.8%
-
Unscored
CVE-2018-8331 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 20%
-
Unscored
CVE-2018-8332 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Win32k Graphics Remote Cod…EPSS 19%
-
Unscored
CVE-2018-8335 A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to the server, aka "Wind…EPSS 9%
-
Unscored
CVE-2018-8336 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.8%
-
Unscored
CVE-2018-8337 A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security …EPSS 1.5%
-
Unscored
CVE-2018-8366 An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information …EPSS 5%
-
Unscored
CVE-2018-8392 A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Da…EPSS 23%
-
Unscored
CVE-2018-8393 A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Da…EPSS 22%
-
Unscored
CVE-2018-8419 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel Information Disclosur…EPSS 1.7%
-
Unscored
CVE-2018-8421 A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability."…EPSS 29%
-
Unscored
CVE-2018-8422 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 6.3%
-
Unscored
CVE-2018-8424 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 13%
-
Unscored
CVE-2018-8425 A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso…EPSS 3.5%
-
Unscored
CVE-2018-8426 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 2.3%
-
Unscored
CVE-2018-8428 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 1.7%
-
Unscored
CVE-2018-8429 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur…EPSS 12%
-
Unscored
CVE-2018-8430 A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word PDF Remote Code Execution Vulnerability.…EPSS 23%
-
Unscored
CVE-2018-8431 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.3%
-
Unscored
CVE-2018-8433 An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka "Microsoft Graphics Component Info…EPSS 2.6%
-
Unscored
CVE-2018-8434 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a…EPSS 3.5%
-
Unscored
CVE-2018-8435 A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature B…EPSS 1.4%
-
Unscored
CVE-2018-8436 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 2.1%
-
Unscored
CVE-2018-8437 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 2.1%
-
Unscored
CVE-2018-8438 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 7.2%
-
Unscored
CVE-2018-8439 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 4.3%
-
Unscored
CVE-2018-8441 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows Subsystem for Linux Elevation of Privile…EPSS 1.1%
-
Unscored
CVE-2018-8442 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.8%
-
Unscored
CVE-2018-8443 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.8%
-
Unscored
CVE-2018-8444 An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka "Windows SMB…EPSS 5.9%
-
Unscored
CVE-2018-8445 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.8%
-
Unscored
CVE-2018-8446 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 2.8%
-
Unscored
CVE-2018-8447 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 13%
-
Unscored
CVE-2018-8455 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnera…EPSS 1.1%
-
Unscored
CVE-2018-8457 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr…EPSS 13%
-
Unscored
CVE-2018-8461 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 13%
-
Unscored
CVE-2018-8462 An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke…EPSS 1.2%
-
Unscored
CVE-2018-8464 An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge PDF Remote Code Executio…EPSS 43%
-
Unscored
CVE-2018-8470 A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) conditio…EPSS 3.3%
-
Unscored
CVE-2018-8475 A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerabil…EPSS 16%
-
Unscored
CVE-2018-8479 A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spo…EPSS 2.1%