Microsoft Patch Tuesday — November 2019
Tuesday, 12 November 2019
- Vulnerabilities
- 72
- Critical
- 0
- High
- 4
- Zero-days
- 0
- Public exploit
- 5
Exploited 4
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 7.8
CVE-2019-1405 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP…EPSS 30%
-
High 7.8
CVE-2019-1388 Exploited Public exploit An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Di…EPSS 8.6%
-
High 7.8
CVE-2019-1385 Exploited An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys…EPSS 3.6%
-
High 7.5
CVE-2019-1429 Exploited Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 77%
Public exploit code 2
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2019-1402 Public exploit An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office…EPSS 2.4%
-
Unscored
CVE-2019-1422 Public exploit An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Windows Elevation of …EPSS 2.1%
All vulnerabilities 72
High4 ShowHide
-
High 7.8
CVE-2019-1405 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP…EPSS 30%
-
High 7.8
CVE-2019-1388 Exploited Public exploit An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Di…EPSS 8.6%
-
High 7.8
CVE-2019-1385 Exploited An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys…EPSS 3.6%
-
High 7.5
CVE-2019-1429 Exploited Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 77%
Unscored68 ShowHide
-
Unscored
CVE-2019-1402 Public exploit An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office…EPSS 2.4%
-
Unscored
CVE-2019-1422 Public exploit An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Windows Elevation of …EPSS 2.1%
-
Unscored
CVE-2019-0712 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 5.6%
-
Unscored
CVE-2019-0719 A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o…EPSS 11%
-
Unscored
CVE-2019-0721 A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o…EPSS 12%
-
Unscored
CVE-2019-1234 A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.EPSS 75%
-
Unscored
CVE-2019-1309 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 5.5%
-
Unscored
CVE-2019-1310 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu…EPSS 5.5%
-
Unscored
CVE-2019-1324 An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles IPv6 flowlabel filled in packets, aka 'Windows TCP/IP Informati…EPSS 4.6%
-
Unscored
CVE-2019-1370 An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information D…EPSS 1.6%
-
Unscored
CVE-2019-1373 A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code …EPSS 22%
-
Unscored
CVE-2019-1374 An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error Reporting Information Dis…EPSS 7.1%
- Unscored
- Unscored
-
Unscored
CVE-2019-1381 An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft Windows Informatio…EPSS 1.6%
-
Unscored
CVE-2019-1382 An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka 'Microsoft ActiveX I…EPSS 1.2%
- Unscored
-
Unscored
CVE-2019-1384 A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an a…EPSS 7%
-
Unscored
CVE-2019-1389 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 4.9%
-
Unscored
CVE-2019-1390 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.EPSS 7.8%
-
Unscored
CVE-2019-1391 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is uniqu…EPSS 1.3%
- Unscored
-
Unscored
CVE-2019-1393 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.4%
-
Unscored
CVE-2019-1394 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2019-1395 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2019-1396 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.2%
-
Unscored
CVE-2019-1397 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 4.9%
-
Unscored
CVE-2019-1398 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 3.3%
-
Unscored
CVE-2019-1399 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s…EPSS 1.7%
-
Unscored
CVE-2019-1406 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex…EPSS 13%
- Unscored
-
Unscored
CVE-2019-1408 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.4%
-
Unscored
CVE-2019-1409 An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memory, aka 'Windows Remo…EPSS 1.4%
-
Unscored
CVE-2019-1411 An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner…EPSS 5.2%
-
Unscored
CVE-2019-1412 An information disclosure vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objects in memory, aka 'O…EPSS 1.7%
-
Unscored
CVE-2019-1413 A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permission for all_urls, aka…EPSS 1.1%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2019-1418 An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Inform…EPSS 1.7%
-
Unscored
CVE-2019-1419 A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fon…EPSS 12%
-
Unscored
CVE-2019-1420 An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation in a secured locat…EPSS 1%
-
Unscored
CVE-2019-1423 An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Windows Elevation of Pr…EPSS 1.4%
-
Unscored
CVE-2019-1424 A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel, aka 'NetLogon Security Feature Bypass …EPSS 3.1%
-
Unscored
CVE-2019-1425 An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka 'Visual Studio Elev…EPSS 3.3%
-
Unscored
CVE-2019-1426 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engi…EPSS 9.8%
-
Unscored
CVE-2019-1427 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engi…EPSS 9.8%
-
Unscored
CVE-2019-1428 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engi…EPSS 9.8%
-
Unscored
CVE-2019-1430 A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An attacker who successful…EPSS 14%
-
Unscored
CVE-2019-1432 An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner…EPSS 5.6%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2019-1436 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 1.8%
- Unscored
- Unscored
-
Unscored
CVE-2019-1439 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 75%
-
Unscored
CVE-2019-1440 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 2.1%
-
Unscored
CVE-2019-1441 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Cod…EPSS 13%
-
Unscored
CVE-2019-1442 A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which cou…EPSS 2.2%
-
Unscored
CVE-2019-1443 An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authentica…EPSS 5.7%
- Unscored
-
Unscored
CVE-2019-1446 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur…EPSS 8.9%
- Unscored
-
Unscored
CVE-2019-1448 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem…EPSS 30%
-
Unscored
CVE-2019-1449 A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a stan…EPSS 6.8%
-
Unscored
CVE-2019-1456 A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fon…EPSS 9.7%
-
Unscored
CVE-2019-1457 A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel S…EPSS 3.7%