Does anybody happen to work for the #Microsoft #Security #Response #Center #MSRC ?
I just applied to https://jobs.careers.microsoft.com/global/en/job/1803115 and wanted to touch base with someone internally, to prove that I'm a real human and not a AI agent 😂
The final day of #ZeroDayQuest was truly a blast 💥 While I’m still unpacking all that has happened (not to mention a baggage full of swag), I’d like to thank once again #MSRC for their warm welcome and impeccable organization.
I’m so happy to have been part of an event that has already made history in our industry. Congratulations to all the winners! Cheers, my friends 🥂
Guide des mises à jour de sécurité Microsoft
https://msrc.microsoft.com/update-guide/vulnerability
#Infosec #Security #Cybersecurity #CeptBiro #Guide #MisesAjour #Microsoft #WindowsUpdate #MSRC
Is #Microsoft #Defender for #Identity part of the #MSRC #Bounty program?
Asking for a fried.
Happy to announce that, with 23 valid reports and 660 total case points, I’m 25th worldwide in this year’s #MSRC Most Valuable Researcher (#MVR) leaderboard!
https://msrc.microsoft.com/leaderboard
Stay tuned to the @hnsec blog for a comprehensive writeup. And, who knows, perhaps even a conference talk is brewing…
Reporting issues in Windows. 🤡
* August, 25, 2023: Issue reported to MSRC.
…
* April 9, 2024: Fix released as CVE-2024-20693.
* April 25, 2024: MSRC asks Microsoft Bounty Team for an update, CCing us.
* April 26, 2024: Microsoft Bounty Team sends back a boilerplate reply that the case is under review.
* May 17, 2024: MSRC asks Microsoft Bounty Team for an update, CCing us again.
* May 22, 2024: Microsoft Bounty Team replies that the vulnerability is out of scope for a bounty, claiming it wasn’t reproduced on the right WIP build.
New Microsoft Security Response Center (MSRC) security advisory for Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability CVE-2024-29991 (5.0 medium). A lot of information is revealed: attack complexity=high, and MSRC says that it would need to be used in an exploit chain for an attack. An attacker must send the user a malicious file and convince them to open it. 🔗 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29991
Umm... Microsoft Security Response Center (MSRC) just updated 38 security advisories. Most of them are titled "Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability", unique CVE IDs (not duplicates in the RSS feed), and appear to be from April 2024 Patch Tuesday. I'm currently assessing what updates were made.
cc: @campuscodi
Microsoft Security Response Center (MSRC) creates security advisories for the same 3 Chromium vulnerabilities identified in Google Chrome's blog post on Wednesday:
No additional information provided. No mention of exploitation.
#Google #Chrome #vulnerability #MSRC #Microsoft #CVE_2024_3515 #CVE_2024_3516 #CVE_2024_3517
Microsoft Security Response Center (MSRC) suspiciously updated four security advisories from this week:
Enough information in CVE-2024-29053's FAQ is provided to potentially develop an exploit without relying on a patch diffing. 29054 and 29055 are identical FAQs.
#CVE_2024_26234 #CVE_2024_29053 #CVE_2024_29054 #CVE_2024_29055 #vulnerability #Microsoft #MSRC #PatchTuesday
WILD! Microsoft Security Response Center (MSRC) releases an additional security advisory for a 2 year old vulnerability with a unique CVE ID: Intel: CVE-2022-0001 Branch History Injection (4.7 medium, CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), disclosed 08 March 2022 by Intel). Not publicly disclosed, not exploited, and exploitation less likely. 🔗 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-0001
#Microsoft #MSRC #PatchTuesday #vulnerability #CVE_2022_0001
Microsoft Security Response Center (MSRC) indicated that they will adopt the Common Weakness Enumeration (CWE) industry standard when identifying a root causeof security vulnerabilities in Microsoft products and services. 🔗 https://msrc.microsoft.com/blog/2024/04/toward-greater-transparency-adopting-the-cwe-standard-for-microsoft-cves/
Happy Patch Tuesday from Microsoft: 155 vulnerabilities.
EDIT: 1 vulnerability was updated to say Exploited and Publicly Disclosed: CVE-2024-26234 (6.7 medium) THIS IS AN EXPLOITED ZERO-DAY! See Sophos article for information on a malicious executable signed by a valid Microsoft Hardware Publisher Certificate: https://news.sophos.com/en-us/2024/04/09/smoke-and-screen-mirrors-a-strange-signed-backdoor/
Updated CVE to correct exploit status. This is an informational update only.
cc: @campuscodi @briankrebs @todb @serghei
#PatchTuesday #Microsoft #MSRC #Vulnerability #CVE_2024_26234 #eitw #activeexploitation
Am I the only one having problems logging in with a Live account at #MSRC?
I can use my work account, but with my #Live account I get the error "unauthorized_client: The client does not exist or is not enabled for consumers.".
Microsoft Security Response Center (MSRC) published security advisories that follow the Google Chrome blog post (check original toot above this reply)
The last two are marked Not Exploited, Not Publicly Disclosed, and Exploitation Less Likely.
DHS Cyber Safety Review Board (CSRB) absolutely savages Microsoft over the June 2023 Exchange Online breach by Chinese threat actor Storm-0558 and accessing U.S. government emails right before Secretary of State Anthony Blinken was to visit China. This 34 page PDF is written in the style of a U.S. Government Accountability Office (GAO) report. 🔗 https://www.dhs.gov/news/2024/04/02/cyber-safety-review-board-releases-report-microsoft-online-exchange-incident-summer
Key takeways (copied verbatim, emphasis mine):
#DHS #CSRB #Microsoft #MSRC #China #cyberespionage #Storm0558
Microsoft Security Response Center (MSRC) published 4 Chromium security advisories (none exploited) that don't contain any additional information beyond what was already disclosed in Google Chrome's blog post:
It appears Microsoft messed up again and forgot to publish this back in January 2024's Patch Tuesday:
"This CVE was addressed by updates that were released in January 2024, but the CVE was inadvertently omitted from the January 2024 Security Updates."
@mwulftange of @codewhitesec publicly disclosed the vulnerability details of "Leaking ObjRefs to Exploit HTTP .NET Remoting" on 27 February 2024: 🔗 https://code-white.com/blog/leaking-objrefs-to-exploit-http-dotnet-remoting/
This concludes the case. No CVE was assigned, nor was there any acknowledgment."
well @mwulftange, CVE-2024-29059 was assigned and you were given credit. 👍
The same Proof of Concept was also provided at GitHub: https://github.com/codewhitesec/HttpRemotingObjRefLeak
Unexpected Microsoft Security Response Center (MSRC) security advisory: CVE-2024-29059 (7.5 high) .NET Framework Information Disclosure Vulnerability: An attacker who successfully exploited this vulnerability could obtain the ObjRef URI which could lead to Remote Code Execution. 🔗 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29059
Not exploited. not publicly disclosed, exploitation more likely. Interesting that MSRC made a syntax error which reveals that they use markdown language ** to make their Questions bold.
