'Tis the Season for 0-days
Summary: Cisco Talos reported that Microsoft released a bulletin for a new 0-day in Internet Explorer versions 7 and 8, tracked as CVE-2010-3971, for which Talos had already shipped coverage in sids 18196 and 18240 before the bulletin or CVE existed. Talos also flagged two other 0-days circulating at the time: a vulnerable Active-X control allowing remote code execution, covered by sids 18241 and 18242, and a Windows 7 IIS7.5 FTP server vulnerability covered by sid 18243, neither of which had in-depth bulletins written about them, only openly available exploit code.
Key Takeaway: The IIS7.5 FTP flaw requires no authentication and can lead to remote code execution, and with only public exploit code and no detailed bulletin to guide defenders, any server still running FTP is exposed.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026