**Is the Preview Pane an attack vector for this vulnerability?**

No, the Preview Pane is not an attack vector.

CVE-2022-24473: Microsoft Excel Remote Code Execution Vulnerability

**Why is this GitHub CVE included in the Security Update Guide?**

The vulnerability assigned to this CVE is in Git for Windows software which is consumed by Microsoft Visual Studio. It is being documented in the Security Update Guide to announce that the latest builds of Visual Studio are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

CVE-2022-24765: GitHub: Uncontrolled search for the Git directory in Git for Windows

CVE-2022-24767: GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account

**How could an attacker exploit this vulnerability?**

An authenticated user could run a specially crafted trusted solution package to execute arbitrary SQL commands. From there the attacker could escalate and execute commands as db\_owner within their Dynamics 356 database.

CVE-2022-23259: Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability

Lapsus$ hackers leaked Microsoft’s Bing and Cortana source code. How bad is that, really?

The Tricky Aftermath of Source Code Leaks

Plus: Microsoft seizes Russian GRU domains, Cash App’s data breach, and Obama’s disinfo admission.

TSA’s Terrorist Watch List Comes for Amtrak Passengers

Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page.

**Work on big ideas, without the busywork.**

From the small stuff to the big picture, Asana organizes work so teams know what to do, why it matters, and how to get it done.

Collect creative feedbackCollect creative feedback

Get budget sign-offGet budget sign-off

Launch brand campaignLaunch brand campaign

PROJECT MANAGEMENT**Stay organized and connected**

Bring your team’s work together in one shared space. Choose the project view that suits your style, and collaborate no matter where you are.

**Everhour**

For time tracking. Set up project budgets, track hours, and more in Asana.

**Microsoft Teams**

For communication. Add and collaborate on Asana tasks without leaving Teams.

**Google Sheets**

For reporting. Pull data from Asana into Sheets to make custom tables, charts, and more.

**Zoom**

For coordination. Turn action items from meetings into tasks in Asana right from Zoom.

**Adobe Creative Cloud**

For communication. See Asana tasks, get feedback, and more right from your Adobe apps.

**Google Calendar**

For time management. Add your Asana tasks to your calendar to see deadlines.

**Harvest**

For time tracking. Track time to record billable hours and create invoices in Asana.

**Dropbox**

For file sharing. Attach files from Dropbox to Asana tasks from the Asana task pane.

**Slack**

For communication. Add, assign, even comment on Asana tasks (and more) in Slack.

**Google Drive**

For file sharing. Attach files from Google Drive to Asana tasks from the task pane.

**Jira Cloud**

For coordination. Create Jira issues and track work without leaving Asana.

**Salesforce**

For coordination. Collaborate on Asana tasks for pre-sales needs in Salesforce.

**Gmail**

For coordination. Turn email into tasks in Asana right from your Gmail inbox.

**OneDrive**

For file sharing. Attach Microsoft files to your Asana tasks from the Asana task pane.

**Zapier**

For connecting apps. Connect with 1000+ apps to share data and automate routine work.

**Tableau**

For reporting. Pull data from Asana into Tableau to create custom dashboards.

**Sharepoint**

For file sharing. Attach files from Sharepoint to Asana tasks from the Asana task pane.

**Outlook**

For coordination. Turn emails into tasks in Asana right from your Outlook inbox.

**Office 365**

For communication. Stay up to date on work in Asana without leaving Microsoft groups.

**Box**

For file sharing. Attach files from Box to Asana tasks from the Asana task pane.

**Microsoft Power BI**

For reporting. Pull data from Asana into Power BI to create custom dashboards.

**Instagantt**

For scheduling. Make Gantt charts to see Asana tasks and more on timelines.

Reporting

**Get the whole picture. Finally.**

Keep an eye on your team's progress and workload. Get real-time charts and other visual highlights to share status, spot potential problems, and keep work on track.

CVE-2022-26877: Manage your team’s work, projects, & tasks online • Asana

jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.

CVE-2022-28796

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

Tag

#microsoft