A total of 108 vulnerabilities were fixed in Windows 10 this month’s Patch Tuesday activity

For ordinary users, there is nothing new in the Windows 10 cumulative update released this month’s Patch Tuesday event, mainly to optimize system security. But for Windows and Microsoft Exchange administrators, have been very busy in recent months. The cumulative update in April fixed 5 zero-day vulnerabilities and more Exchange vulnerabilities.

In today’s update, Microsoft has fixed a total of 108 vulnerabilities, of which 19 are marked as “Critial” and 89 are marked as “Important.” And these vulnerabilities do not include the six Chromium Edge vulnerabilities released earlier this month.

Join Our Microsoft Channel On Telegram

In addition, today Microsoft also fixed five publicly disclosed zero-day vulnerabilities, of which one is known to be used in cyber attacks. To make matters worse, Microsoft fixed four key Microsoft Exchange vulnerabilities discovered by the NSA. As part of today’s Patch Tuesday, Microsoft has fixed four publicly disclosed vulnerabilities and one actively exploited vulnerability. The following four vulnerabilities Microsoft stated that they have been exposed publicly, but there is no evidence that they have been exploited by hackers.

• CVE-2021-27091 -RPC Endpoint Mapper Service Privilege Escalation Vulnerability
• CVE-2021-28312 -Windows NTFS Denial of Service Vulnerability
• CVE-2021-28437 -Windows Installer Information Disclosure Vulnerability-PolarBear
• CVE-2021-28458 -Privilege escalation vulnerability in Azure ms-rest-nodeauth library

The following vulnerabilities discovered by Kaspersky researcher Boris Larin have been exploited by the hacker organization BITTER APT.

• CVE-2021-28310 -Win32k Elevation of Privilege Vulnerability

Kaspersky explained in the blog post: “Unfortunately, we were unable to capture a complete chain, so we don’t know whether the vulnerability is used in conjunction with another browser zero-day, or with a known, patched Vulnerabilities are used together”. The administrators of Microsoft Exchange did not get any rest, because today another 4 critical remote code execution vulnerabilities discovered by the NSA have been fixed in Microsoft Exchange. Two of the vulnerabilities are pre-authentication, which means they do not require an attacker to log in to the server first.

• CVE-2021-28480 – Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-28481 -Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-28482 -Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-28483 -Microsoft Exchange Server Remote Code Execution Vulnerability

This report contains detail for the following vulnerabilities:

Source

If you like our news and you want to see such news even further, then follow RealMi Central on Telegram, Twitter, Facebook (Page) (Group) & Instagram.