Microsoft Patch Tuesday — January 2019
Tuesday, 8 January 2019
- Vulnerabilities
- 50
- Critical
- 0
- High
- 8
- Zero-days
- 0
- Public exploit
- 13
Exploited 2
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 8.8
CVE-2019-0541 Exploited Public exploit A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili…EPSS 53%
-
High 7.8
CVE-2019-0543 Exploited Public exploit An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerabi…EPSS 4.7%
Public exploit code 11
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 83%
- High 7.5 EPSS 80%
- High 7.5 EPSS 69%
-
Unscored
CVE-2019-0555 Public exploit An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the b…EPSS 2.7%
-
Unscored
CVE-2019-0552 Public exploit An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Wi…EPSS 2.5%
-
Unscored
CVE-2019-0566 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This aff…EPSS 19%
-
Unscored
CVE-2019-0570 Public exploit An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulne…EPSS 3%
-
Unscored
CVE-2019-0571 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 16%
-
Unscored
CVE-2019-0572 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 25%
-
Unscored
CVE-2019-0573 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 20%
-
Unscored
CVE-2019-0574 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 19%
All vulnerabilities 50
High8 ShowHide
-
High 8.8
CVE-2019-0541 Exploited Public exploit A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili…EPSS 53%
-
High 7.8
CVE-2019-0543 Exploited Public exploit An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerabi…EPSS 4.7%
- High 8.8 EPSS 3.2%
- High 7.5 EPSS 83%
- High 7.5 EPSS 80%
- High 7.5 EPSS 69%
- High 7.5 EPSS 9.6%
- High 7.5 EPSS 8.4%
Medium3 ShowHide
-
Medium 5.4
CVE-2019-0556 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.6%
-
Medium 5.4
CVE-2019-0557 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 2.1%
-
Medium 5.4
CVE-2019-0558 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 2%
Unscored39 ShowHide
-
Unscored
CVE-2019-0555 Public exploit An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the b…EPSS 2.7%
-
Unscored
CVE-2019-0552 Public exploit An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Wi…EPSS 2.5%
-
Unscored
CVE-2019-0566 Public exploit An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This aff…EPSS 19%
-
Unscored
CVE-2019-0570 Public exploit An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulne…EPSS 3%
-
Unscored
CVE-2019-0571 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 16%
-
Unscored
CVE-2019-0572 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 25%
-
Unscored
CVE-2019-0573 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 20%
-
Unscored
CVE-2019-0574 Public exploit An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev…EPSS 19%
-
Unscored
CVE-2019-0536 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2019-0537 An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file,…EPSS 7.6%
-
Unscored
CVE-2019-0538 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 20%
-
Unscored
CVE-2019-0546 A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Stu…EPSS 16%
-
Unscored
CVE-2019-0547 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Clie…EPSS 71%
-
Unscored
CVE-2019-0548 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects AS…EPSS 8.2%
-
Unscored
CVE-2019-0549 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2019-0550 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 4.5%
-
Unscored
CVE-2019-0551 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 4.5%
-
Unscored
CVE-2019-0553 An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows Subsystem for Linux Informat…EPSS 1.8%
-
Unscored
CVE-2019-0554 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2019-0559 An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosu…EPSS 6.8%
-
Unscored
CVE-2019-0560 An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclos…EPSS 8.7%
-
Unscored
CVE-2019-0561 An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability.…EPSS 7.9%
-
Unscored
CVE-2019-0562 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 1.7%
-
Unscored
CVE-2019-0565 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T…EPSS 9.5%
-
Unscored
CVE-2019-0569 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2019-0575 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 14%
-
Unscored
CVE-2019-0576 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 17%
-
Unscored
CVE-2019-0577 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 17%
-
Unscored
CVE-2019-0578 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 14%
-
Unscored
CVE-2019-0579 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 17%
-
Unscored
CVE-2019-0580 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 17%
-
Unscored
CVE-2019-0581 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 14%
-
Unscored
CVE-2019-0582 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 12%
-
Unscored
CVE-2019-0583 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 16%
-
Unscored
CVE-2019-0584 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex…EPSS 14%
-
Unscored
CVE-2019-0585 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe…EPSS 22%
-
Unscored
CVE-2019-0586 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchan…EPSS 15%
-
Unscored
CVE-2019-0588 An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka…EPSS 4.6%
-
Unscored
CVE-2019-0622 An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevati…EPSS 2%