{"id":8687,"date":"2021-04-22T06:41:20","date_gmt":"2021-04-22T13:41:20","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8687"},"modified":"2023-03-07T15:20:25","modified_gmt":"2023-03-07T22:20:25","slug":"april-microsoft-patches-108-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/10.42.32.162\/patch_watch\/april-microsoft-patches-108-security-vulnerabilities\/","title":{"rendered":"April: Microsoft Patches 108 Security Vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Microsoft patched 108 unique security vulnerabilities in April 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority.<\/p>\n<h2 dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter\" style=\"width: 700px; height: 401px;\" src=\"\/wp-content\/uploads\/2015\/11\/highlights_.jpg\" alt=\"\" \/><\/h2>\n<h2 dir=\"ltr\">Microsoft\u2019s April Patches Overview<\/h2>\n<p dir=\"ltr\">In April, Microsoft patched 108 vulnerabilities discovered in 2021 &#8211;<\/p>\n<p dir=\"ltr\"><strong>RCE\/PE:<\/strong> Remote Code Execution and Privilege Execution are two of the most dangerous weaknesses that are most exploited by malicious actors. Microsoft has fixed &#8211;<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">56 CVEs that have been classified as RCE bugs<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">19 CVEs have Privilege Escalation capabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">9 CVEs are linked to Denial of Service<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\">Notably, four CVEs ( CVE-2021-28458, CVE-2021-27091, CVE-2021-2843, CVE-2021-28312) have publicly known exploits therefore, patching them would be essential.<\/p>\n<p dir=\"ltr\">The National Security Agency US has discovered four new Exchange server vulnerabilities (CVE-2021-28480, CVE-2021-28481, CVE-2021-28482, and CVE-2021-28483), which have been rated critical. Of these 2 vulnerabilities are pre-authentication weaknesses, which means unauthenticated attackers can exploit them without any user interaction.<\/p>\n<p dir=\"ltr\"><strong>Zero-Day Vulnerabilities:<\/strong> Microsoft has released 4 publicly disclosed and 1 actively exploited patches for five Zero-Day Vulnerabilities (<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2021-27091\"> CVE-2021-2709<\/a>,<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2021-28312\"> CVE-2021-28312<\/a>,<a href=\"http:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2021-28437\"> CVE-2021-28437<\/a>,<a href=\"http:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2021-28458\"> CVE-2021-28458<\/a>,<a href=\"http:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2021-28310\"> CVE-2021-28310<\/a>)<\/p>\n<p dir=\"ltr\">The actively exploited CVE-2021-28310 in Win32k with Privilege Escalation capabilities is suspected to be associated with Bitter APT Group.<\/p>\n<h2 dir=\"ltr\">Product Analysis<\/h2>\n<p dir=\"ltr\">Microsoft has released patches for 45 different products where 59% of security vulnerabilities accounted for RCE exploit.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 700px; height: 520px;\" src=\"\/wp-content\/uploads\/2015\/11\/product-analysis.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 384px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watches-2021.jpg\" alt=\"\" \/><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrHxZ7kHXg7CBCIX?backgroundColor=cyan&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\"><span style=\"font-size: 12px;\"><strong>Table: Microsoft April 2021 Patches<\/strong><\/span><\/p>\n<p dir=\"ltr\">These critical vulnerabilities are actively exploited and they need to be patched on priority.<\/p>\n<p dir=\"ltr\">\n","protected":false},"excerpt":{"rendered":"<p>Microsoft patched 108 unique security vulnerabilities in April 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority. Microsoft\u2019s April Patches Overview In April, Microsoft patched 108 vulnerabilities discovered in 2021 &#8211; RCE\/PE: Remote Code Execution and Privilege Execution are two of the most dangerous weaknesses that are most [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14440,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[290],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch\/8687"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14440"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=8687"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_category?post=8687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}