Microsoft Patch Tuesday, August 2023 Edition

Summary: Microsoft released updates addressing more than 70 security holes in Windows and related products, six of them rated critical, including zero-days already exploited in the wild. The batch covers CVE-2023-36884, a Windows Search security feature bypass that Microsoft also addressed with a defense-in-depth update ADV230003, and CVE-2023-38180, a .NET and Visual Studio denial-of-service flaw under active attack.
Key Takeaway: CVE-2023-21709, an Exchange Server elevation-of-privilege flaw, carries a CVSSv3 score of 9.8 out of 10 because an unauthenticated attacker can brute-force valid accounts, and weak passwords are what decide whether that attempt succeeds.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-21709 CVE-2023-36884 CVE-2023-36910 CVE-2023-38180
Related: Six critical vulnerabilities included in August’s Microsoft security update Cyber Risks ·
CVE-2023-38180: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability Known Exploited Vulnerabilities · Aug 09, 2023
CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jul 17, 2023