Microsoft Exchange Bug Exposes ~100,000 Windows Domain Credentials – Tempemail

An unpatched design flaw in the implementation of Microsoft Exchange’s Autodiscover protocol has resulted in the leak of approximately 100,000 login names and passwords for Windows domains worldwide. “This is a severe security issue, since if an attacker can control such domains or has the ability to ‘sniff’ traffic in Continue Reading

A New Bug in Microsoft Windows Could Let Hackers Easily Install a Rootkit – Tempemail

Security researchers have disclosed an unpatched weakness in Microsoft Windows Platform Binary Table (WPBT) affecting all Windows-based devices since Windows 8 that could be potentially exploited to install a rootkit and compromise the integrity of devices. “These flaws make every Windows system vulnerable to easily-crafted attacks that install fraudulent vendor-specific Continue Reading

Microsoft Warns of a Wide-Scale Phishing-as-a-Service Operation – Tempemail

Microsoft has opened the lid on a large-scale phishing-as-a-service (PHaaS) operation that’s involved in selling phishing kits and email templates as well as providing hosting and automated services at a low cost, thus enabling cyber actors to purchase phishing campaigns and deploy them with minimal efforts. “With over 100 available Continue Reading

Exploitation of the CVE-2021-40444 vulnerability in MSHTML- Tempemail

Summary Last week, Microsoft reported the remote code execution vulnerability CVE-2021-40444 in the MSHTML browser engine. According to the company, this vulnerability has already been used in targeted attacks against Microsoft Office users. In attempt to exploit this vulnerability, attackers create a document with a specially-crafted object. If a user Continue Reading

Critical Flaws Discovered in Azure App That Microsoft Secretly Installed on Linux VMs – Tempemail

Microsoft on Tuesday addressed a quartet of security flaws as part of its Patch Tuesday updates that could be abused by adversaries to target Azure cloud customers and elevate privileges as well as allow for remote takeover of vulnerable systems. The list of flaws, collectively called OMIGOD by researchers from Continue Reading

Microsoft Releases Patch for Actively Exploited Windows Zero-Day Vulnerability – Tempemail

A day after Apple and Google rolled out urgent security updates, Microsoft has pushed software fixes as part of its monthly Patch Tuesday release cycle to plug 66 security holes affecting Windows and other components such as Azure, Office, BitLocker, and Visual Studio, including an actively exploited zero-day in its Continue Reading

Microsoft Warns of Cross-Account Takeover Bug in Azure Container Instances – Tempemail

Microsoft on Wednesday said it remediated a vulnerability in its Azure Container Instances (ACI) services that could have been exploited by a malicious actor “to access other customers’ information” in what the researcher described as the “first cross-account container takeover in the public cloud.” An attacker exploiting the weakness could Continue Reading

New 0-Day Attack Targeting Windows Users With Microsoft Office Documents – Tempemail

Microsoft on Tuesday warned of an actively exploited zero-day flaw impacting Internet Explorer that’s being used to hijack vulnerable Windows systems by leveraging weaponized Office documents. Tracked as CVE-2021-40444 (CVSS score: 8.8), the remote code execution flaw is rooted in MSHTML (aka Trident), a proprietary browser engine for the now-discontinued Continue Reading

Microsoft Says Chinese Hackers Were Behind SolarWinds Serv-U SSH 0-Day Attack – Tempemail

Microsoft has shared technical details about a now-fixed, actively exploited critical security vulnerability affecting SolarWinds Serv-U managed file transfer service that it has attributed with “high confidence” to a threat actor operating out of China. In mid-July, the Texas-based company remedied a remote code execution flaw (CVE-2021-35211) that was rooted Continue Reading