News

Latest news on the subject of B2B cyber security >>> PR agencies: Add us to your mailing list - see contact! >>> Book an exclusive PartnerChannel for your news!

Tag: Microsoft

Vulnerability in Outlook - business at risk
22 March 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

A security lab has discovered a serious vulnerability in Microsoft Outlook that is being used against European government, military, energy and transport companies. The vulnerability has the designation CVE-2023-23397 and is classified according to the Common Vulnerability Scoring System (CVSS) with a value of 9.8. The BSI also says: The attack occurs before the e-mail is opened or before it is displayed in the preview window - no action by the recipient is necessary! The vulnerability allows an unauthorized attacker to compromise systems with a specially crafted email. Through this malicious email he receives…

Read more

BSI warns: exploitation of a vulnerability in MS Outlook
16 March 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

The BSI warns of a vulnerability in Outlook that is apparently already being actively exploited. The CVSS value of the vulnerability is 9.8 and is therefore considered critical. Microsoft is already providing an update that should be installed immediately if it didn't happen automatically. On March 14, 2023, Microsoft released updates for numerous vulnerabilities as part of its monthly Patch Days - including several patches for security vulnerabilities that are classified as "critical" according to the Common Vulnerability Scoring System (CVSS) with values ​​of 9.0 and higher. Important patch ready In the…

Read more

Microsoft Word with critical 9.8 vulnerability
8 March 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

Every Word user should check whether their Word has already been updated by Microsoft. CVE-2023-21716 describes a critical vulnerability with a severity level of 9.8 out of 10 according to CVSS 3.1. Checking the version is quite simple. Incidentally, Microsoft released a Word vulnerability with a severity level of 9.8 out of 10 according to CVSS 3.1. This critical vulnerability allows opening a manipulated Rich Text Format (.rtf) document to allow malicious code injection. Although Microsoft describes the danger of the vulnerability on its website, it does not provide any further information. This information can be found at…

Read more

Patches for 75 vulnerabilities
25 February 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

The February 2023 Patchday release contains patches for 75 CVEs - nine rated critical and 66 rated important. Also included: Elevation of rights error in Windows, circumvention of security functions in Microsoft Office or security gaps in Microsoft Exchange Server. This month Microsoft fixed three zero-day vulnerabilities exploited by attackers in the wild, including two elevation of privilege bugs and one security feature bypass bug. CVE-2023-23376 Microsoft has patched CVE-2023-23376, an elevation of privilege bug in the Common Log File System (CLFS) driver. Its discovery will bring researchers at the Microsoft Threat Intelligence Center (MSTIC)…

Read more

Microsoft DCOM hardening tool discovers vulnerabilities
14 February 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

Open-source detection tool uncovers vulnerabilities in DCOM ahead of Microsoft's March 2023 patch. Users can quickly determine if their networks contain unsecured DCOM made unusable by the new Microsoft patch. OTORIO has released the open-source Microsoft Distributed Component Object Model (DCOM) Hardening Toolkit. The aim is to protect OT systems from possible problems related to an upcoming Microsoft patch. Because Microsoft itself writes: “14. March 2023, hardening changes are enabled by default with no option to disable them. At this point, you must resolve any compatibility issues with the hardening changes and applications in your environment." Test,…

Read more

Phishing Report shows the current email traps
30 January 2023
| No comments
| Short news
B2B Cyber ​​Security ShortNews

In its new Brand Phishing Report for the fourth quarter of 2022, Check Point presents the new phishing threats. The report highlights the brands most frequently impersonated by hackers in their attempts to steal personal information or payment details in the months of October, November and December of the past year. In general, the technology sector was the industry most impersonated by brand phishing in the last quarter of 2022, followed by logistics and social media. DHL ranked second with 16 percent of all branded phishing attempts, ahead of Microsoft in third…

Read more

Microsoft patches gaps according to NSA information
16 January 2023
| No comments
| Short news
Tenable news

Microsoft's Patchday release this month includes fixes for 98 CVEs, 11 of which are rated Critical and 87 are Major. In addition, Microsoft closes two zero-day vulnerabilities. A lot of information came from the American National Security Agency - NSA. Microsoft says this bug has already been exploited in practice as a zero day: CVE-2023-21674 is an elevation-of-privilege vulnerability in Windows Advanced Local Procedure Call (ALPC) that simplifies interprocess communication for Windows operating system components. Serious zero-day vulnerability Although no details about the flaw were available at the time Microsoft published the advisory on Patch Tuesday, it seems…

Read more

Ransomware attacks: malicious code with valid certificates
20 December 2022
| No comments
| PR News, Sophos
Ransomware attacks: malicious code with valid certificates

Sophos thwarts ransomware attacks with a rare, malicious driver, but signed with a valid Microsoft digital certificate. The driver targets Endpoint Detection and Response (EDR) processes. The attack is linked to the Cuba Ransomware Group. Sophos found malicious code in several drivers signed with legitimate digital certificates. The new report, Signed Driver Malware Moves up the Software Trust Chain, details the investigation that began with an attempted ransomware attack. The attackers used a malicious driver that was bundled with a legitimate Microsoft Windows Hardware Compatibility Publisher digital certificate.

Read more

Voicemail: Microsoft Dynamic 365 abused for phishing
10 December 2022
| No comments
| PR News
Voicemail: Microsoft Dynamic 365 abused for phishing

Cyber ​​criminals use legitimate Microsoft Dynamic 365 Customer Voice software to send phishing links to steal customer data. Security researchers from Avanan and CheckPoint show how insidious the whole thing is. Dynamics 365 Customer Voice is a Microsoft product primarily intended to receive feedback from customers. It can be used for customer satisfaction surveys to track feedback and aggregate data into actionable insights. Additionally, it can also be used to interact with over the phone, collecting the data for further customer input. Instead of this function...

Read more

Microsoft Office 365: Insecure encryption for emails
19 October 2022
| No comments
| Stories
Microsoft Office 365: Insecure encryption for emails

The labs of the security company WithSecure have bad news: The encryption used for emails in Microsoft Office 365 is not secure because it has a security hole. According to WithSecure, Microsoft does not plan to fix the vulnerability, although the National Institute of Standards and Technology NIST lists the vulnerability as serious in its Vulnerability Database. Microsoft Office 365 Message Encryption (OME) uses the Electronic Codebook (ECB) operating mode. This mode is generally insecure and may reveal information about the structure of the messages sent, resulting in partial or full disclosure of the message...

Read more

© 2023 MedPressIT GbR
Cookie Settings