Microsoft Patch Tuesday — November 2018
Tuesday, 13 November 2018
- Vulnerabilities
- 62
- Critical
- 0
- High
- 10
- Zero-days
- 0
- Public exploit
- 5
Exploited 2
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 7.8
CVE-2018-8589 Exploited An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." …EPSS 3%
-
High 7.4
CVE-2018-8581 Exploited Public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects…EPSS 28%
Public exploit code 4
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2018-8544 Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 48%
-
Unscored
CVE-2018-8550 Public exploit An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows 7, Windows Se…EPSS 3.3%
-
Unscored
CVE-2018-8552 Public exploit An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information …EPSS 51%
-
Unscored
CVE-2018-8584 Public exploit An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr…EPSS 2.7%
All vulnerabilities 62
High10 ShowHide
-
High 7.8
CVE-2018-8589 Exploited An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." …EPSS 3%
-
High 7.4
CVE-2018-8581 Exploited Public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects…EPSS 28%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
- High 7.5 EPSS 14%
Medium2 ShowHide
Unscored50 ShowHide
-
Unscored
CVE-2018-8544 Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 48%
-
Unscored
CVE-2018-8550 Public exploit An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows 7, Windows Se…EPSS 3.3%
-
Unscored
CVE-2018-8552 Public exploit An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information …EPSS 51%
-
Unscored
CVE-2018-8584 Public exploit An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr…EPSS 2.7%
-
Unscored
CVE-2018-8256 A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Code Execution Vulner…EPSS 23%
-
Unscored
CVE-2018-8407 An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC Informa…EPSS 1.7%
-
Unscored
CVE-2018-8408 An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vul…EPSS 1.7%
-
Unscored
CVE-2018-8415 A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering Vulnerability." This …EPSS 1.2%
-
Unscored
CVE-2018-8417 A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard, aka "Microsoft JScript Security Featur…EPSS 2%
-
Unscored
CVE-2018-8450 A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability." This affe…EPSS 16%
-
Unscored
CVE-2018-8454 An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Di…EPSS 3.3%
-
Unscored
CVE-2018-8471 An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory, aka "Microsoft Rem…EPSS 1.2%
-
Unscored
CVE-2018-8476 A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows Deployment Service…EPSS 65%
-
Unscored
CVE-2018-8485 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe…EPSS 1.2%
-
Unscored
CVE-2018-8522 A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 19%
-
Unscored
CVE-2018-8524 A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 19%
-
Unscored
CVE-2018-8529 A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Sea…EPSS 13%
-
Unscored
CVE-2018-8539 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe…EPSS 19%
-
Unscored
CVE-2018-8545 An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information Disclosure Vulnera…EPSS 5.9%
-
Unscored
CVE-2018-8546 A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This affects Office 365 Pro…EPSS 5.5%
-
Unscored
CVE-2018-8547 A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properl…EPSS 1.6%
-
Unscored
CVE-2018-8549 A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects…EPSS 1.2%
-
Unscored
CVE-2018-8553 A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote …EPSS 19%
-
Unscored
CVE-2018-8554 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe…EPSS 1.2%
-
Unscored
CVE-2018-8558 An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin …EPSS 5.6%
-
Unscored
CVE-2018-8561 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe…EPSS 1.2%
-
Unscored
CVE-2018-8562 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 1.3%
-
Unscored
CVE-2018-8563 An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affe…EPSS 1.7%
-
Unscored
CVE-2018-8564 A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso…EPSS 2.7%
-
Unscored
CVE-2018-8565 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerabili…EPSS 3.2%
-
Unscored
CVE-2018-8566 A security feature bypass vulnerability exists when Windows improperly suspends BitLocker Device Encryption, aka "BitLocker Security Feature Bypass Vulnerabili…EPSS 1.1%
-
Unscored
CVE-2018-8567 An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access inf…EPSS 3.1%
-
Unscored
CVE-2018-8570 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 14%
-
Unscored
CVE-2018-8572 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 1.6%
-
Unscored
CVE-2018-8573 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe…EPSS 19%
-
Unscored
CVE-2018-8574 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 19%
-
Unscored
CVE-2018-8575 A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "Microsoft Project Remote Co…EPSS 20%
-
Unscored
CVE-2018-8576 A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 19%
-
Unscored
CVE-2018-8577 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 19%
-
Unscored
CVE-2018-8578 An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, ak…EPSS 4.9%
-
Unscored
CVE-2018-8579 An information disclosure vulnerability exists when attaching files to Outlook messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This aff…EPSS 6.3%
-
Unscored
CVE-2018-8582 A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code …EPSS 19%
-
Unscored
CVE-2018-8592 An elevation of privilege vulnerability exists in Windows 10 version 1809 when installed from physical media (USB, DVD, etc, aka "Windows Elevation Of Privileg…EPSS 1.3%
-
Unscored
CVE-2018-8600 A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service…EPSS 2.3%
-
Unscored
CVE-2018-8602 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross…EPSS 1.7%
-
Unscored
CVE-2018-8605 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a…EPSS 1.6%
-
Unscored
CVE-2018-8606 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a…EPSS 1.6%
-
Unscored
CVE-2018-8607 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a…EPSS 1.6%
-
Unscored
CVE-2018-8608 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a…EPSS 1.6%
-
Unscored
CVE-2018-8609 A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an af…EPSS 9.9%