Security
Headlines
HeadlinesLatestCVEs

Tag

#microsoft

CVE-2022-24509: Microsoft Office Visio Remote Code Execution Vulnerability

**Is the Preview Pane an attack vector for this vulnerability?** No, the Preview Pane is not an attack vector.

Microsoft Security Response Center
Open in Source
#vulnerability#microsoft#Microsoft Office Visio#Security Vulnerability
CVE-2022-24508: Win32 File Enumeration Remote Code Execution Vulnerability

The following workaround may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as they become available even if you plan to leave this workaround in place: **Disable SMBv3 compression** You can disable compression to block authenticated attackers from exploiting the vulnerability against an **SMBv3 Server** with the PowerShell command below. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force **Notes:** 1. No reboot is needed after making the change. 2. **This workaround does not prevent exploitation of SMB clients; please see item 2 under FAQ to protect clients.** You can disable the workaround with the PowerShell command below. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force **Note:** No reboot is needed ...

CVE-2022-23278: Microsoft Defender for Endpoint Spoofing Vulnerability

**Why is Attack Complexity marked as High for this vulnerability?** Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.

CVE-2022-24511: Microsoft Office Word Tampering Vulnerability

**Are the updates for the Microsoft Office for Mac currently available?** The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.

CVE-2022-23277: Microsoft Exchange Server Remote Code Execution Vulnerability

**Does the attacker need to be in an authenticated role in the Exchange Server?** Yes, the attacker must be authenticated.

CVE-2020-8927: Brotli Library Buffer Overflow Vulnerability

**Why is this Google LLC CVE included in the Security Update Guide?** The vulnerability assigned to this CVE is in the Brotli library which is consumed by .NET and by Microsoft Visual Studio. It is being documented in the Security Update Guide to announce that the latest builds of .NET and Visual Studio are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.