Security
Headlines
HeadlinesLatestCVEs

Tag

#microsoft

CVE-2021-38654: Microsoft Office Visio Remote Code Execution Vulnerability

*Is the Preview Pane an attack vector for this vulnerability?* No, the Preview Pane is not an attack vector.

Microsoft Security Response Center
#Microsoft Office Visio#Security Vulnerability#vulnerability#microsoft
CVE-2021-38644: Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability

*Is Windows vulnerable in the default configuration?* No. Only customers who have installed this app from the Microsoft Store may be vulnerable. *How do I get the updated app?* The Microsoft Store will automatically update affected customers. Alternatively, customers can get the update immediately; see here for details. It is possible for customers to disable automatic updates for the Microsoft Store. The Microsoft Store will not automatically install this update for those customers. *My system is in a disconnected environment; is it vulnerable?* Customers using the Microsoft Store for Business and Microsoft Store for Education can get this update through their organizations. *How can I check if the update is installed?* App package versions *1.0.42152.0* and later contain this update. You can check the package version in PowerShell: Get-AppxPackage -Name Microsoft.MPEG2VideoExtension

CVE-2021-36956: Azure Sphere Information Disclosure Vulnerability

*What version of Azure Sphere has the update that protects from this vulnerability?* All versions of Azure Sphere that are 21.08 and higher are protected from this vulnerability. *How do I ensure my Azure Sphere device has the update?* If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.08 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status *Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?* An IoT device that is running Azure Sphere and is connecte...

CVE-2021-38649: Open Management Infrastructure Elevation of Privilege Vulnerability

*Update 9/16/2021: Where can I find more information about how to know if I'm protected and what steps can be taken to be protected?* Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. *What is OMI?* Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. Refer this link for more details : GitHub - microsoft/omi: Open Management In...

CVE-2021-38648: Open Management Infrastructure Elevation of Privilege Vulnerability

*Update 9/16/2021: Where can I find more information about how to know if I'm protected and what steps can be taken to be protected?* Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. *What is OMI?* Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. Refer this link for more details : GitHub - microsoft/omi: Open Management In...

CVE-2021-38647: Open Management Infrastructure Remote Code Execution Vulnerability

*Update 9/16/2021: Where can I find more information about how to know if I'm protected and what steps can be taken to be protected?* Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. *What is OMI?* Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. Refer this link for more details : GitHub - microsoft/omi: Open Management In...

CVE-2021-38645: Open Management Infrastructure Elevation of Privilege Vulnerability

*Update 9/16/2021: Where can I find more information about how to know if I'm protected and what steps can be taken to be protected?* Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. *What is OMI?* Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. Refer this link for more details : GitHub - microsoft/omi: Open Management In...

CVE-2021-38669: Microsoft Edge (Chromium-based) Tampering Vulnerability

*What is the version information for this release?* Microsoft Edge Version Date Released Based on Chromium Version 93.0.961.44 9/9/2021 93.04577.63

RHSA-2021:3473: Red Hat Security Advisory: Red Hat Automation Platform 1.2.5 security and bugfixes update

An update is now available for Red Hat Automation Platform 1.2.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Red Hat Ansible Automation Platform integrates Red Hat’s automation suite consisting of Red Hat Ansible Tower, Red Hat Ansible Engine, and use-case specific capabilities for Microsoft Windows,network, security, and more, along with Software-as-a-Service (SaaS)-based capabilities and features for organization-wide effectiveness. Security Fix(es): * python-urllib3: Catastrophic backtracking in URL authority parser (CVE-2021-33503) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: This update fixes variou...