Skip to main content
Monthly Archives

March 2021

||

Microsoft Releases Windows 10 SSU To Fix Security Update Problem

By NewsNo Comments

Microsoft Releases Windows 10 SSU To Fix Security Update Problem

Microsoft has released a Secure Boot update and is recommending this SSU be prioritized to resolve an important security issue.

SSU Fixes Security Update Issue

Microsoft has released a Secure Boot security update and is recommending this SSU be prioritized as it resolves an issue in the Secure Boot.

CVE-2020-0689 is a vulnerability that could allow attackers to bypass Secure Boot and install untrusted software. The new SSU fixes the issue by making sure prerequisite updates are installed in the proper order for the CVE-2020-0689 security update to install without errors.

Customers using Syxsense Manage and Syxsense Secure can find KB5001205 available now for immediate deployment.

What are Servicing Stack Updates?

Servicing stack updates provide fixes to the Windows servicing stack, the fundamental component that installs Windows updates.

It also contains the “component-based servicing stack” (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components.

Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don’t install the latest servicing stack update, there’s a risk that your device can’t be updated with the latest Microsoft security fixes.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 30, 2021
Love0
||

Why Endpoint Protection Is Critical

By BlogNo Comments

Why Endpoint Protection Is Critical

Despite the growth in IT security technology, endpoints remain vulnerable and organizations continue to be exposed to threats.

Why Safeguarding Endpoints Is Important

Organizations have amassed a formidable array of security technology over the years. Anti-virus, malware protection, intrusion detection/prevention systems, firewalls, access controls, zero-trust architectures, threat intelligence, security and event information management, endpoint detection and response, and more.

Yet endpoints remain vulnerable and organizations continue to be breached.

The Cost of Endpoint Vulnerabilities

A study by the Ponemon Institute found that the bulk of cybercrime is perpetrated via an endpoint. That report places the losses associated with a single endpoint breach at $8.94 million on average — that’s a lot of money. And it’s a number many would question. What has to be understood is that actual dollar losses are not the major element in the calculation.

The $8.94 figure was determined based upon direct economic losses via theft or ransomware, as well as a figuring out the monetary value of lost productivity, system downtime, infrastructure damage, legal costs, and brand impact. The largest portion, it turns, out is not the financial losses. Productivity losses associated with a breach accounted for the highest amount.

Yes, the company had to fork over a ransom. But Ponemon research had found productivity losses following endpoint attacks as the biggest area of financial impact. This finding has held true now for several years in what has become an annual report on the true costs of system breaches.

Take the case of a financial services provider or an oil and gas firm that is down for hours; the revenue losses mounts up fast. Similarly, thousands of personnel being unable to access their systems for several days adds up to a hefty sum in terms of wasted salaries and company profits.

Theft of information is in second place in the Ponemon study. Proprietary information, intellectual property, and confidential databases have value on the dark web and are eagerly sought after by criminals. Thus, it is essential to properly safeguard these assets.

More Security or Better Security?

Quite often, the answer to a surge in attacks is some heavily-hyped new technology. The sales pitch goes along these lines: your existing security arsenal is no longer enough. Therefore, add W, X, and Y, and you will be protected. A few months later, W, X, and Y are no longer sufficient. It is time to implement Z!

Rather than continuing to splurge on the latest and greatest, then, a better approach might be to review what you are doing, what is already in place – and do it better.

Patch management serves as a good case in point. Most organizations think they do a decent job of patch management. Yet vital security patches can go unaddressed for months, distributed patches may not be applied to all machines, and patching can become bogged down in internal approvals, sluggish testing procedures, and manual procedures.

How to Build a Better Patch Strategy

There is a way to do patch management far more effectively. Syxsense Secure offers intelligent and automated patching. Patches issued by vendors to fix holes are reviewed, tested, and distributed by us within three hours.

In addition to patch management, the system also includes integrated vulnerability scanning and IT management. Start a free trial to experience all the powerful features of Syxsense.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 28, 2021
Love0
|||

Syxsense Releases Cortex Covid-Readiness Job Template

By Press ReleaseNo Comments

Syxsense Releases Cortex Covid-Readiness Job Template

Syxsense has announced the availability of the Syxsense Cortex Covid-Readiness Job template for Syxsense Secure customers.

Syxsense Cortex Covid-Readiness Job Template Now Available

Syxsense, a global leader in IT and security management solutions, today announced the availability of its Cortex Covid Readiness Job template for Syxsense Secure customers. This release is the first of many reusable Cortex Jobs to secure and manage IT environments.

Designed to leverage industry expertise, and be available for instant distribution, Cortex Jobs automate previously complex IT and security tasks with pre-created templates that control and monitor progress through a series of clear, concise steps to identify, evaluate and remediate problems.

With more workers returning to the office, the Cortex Covid Readiness Job protects corporate networks from devices that reconnect with unauthorized software installed, outstanding patch vulnerabilities, or open security vulnerabilities. Corporate devices used at home have been exposed to every computer, smart device, or IoT device communicating over the home network, leaving the attack perimeter much broader than ever before.

Set to run on a network connection trigger, the Cortex Covid Readiness Job recognizes device returning to the corporate network and immediately quarantines them from communicating to other network devices. While the device is isolated, Syxsense Secure maintains a direct connection and scans the device for vulnerabilities, alerts IT staff of issues, installs updates, modifies settings, removes risk factors, and then restores the secured device to connected status.

The visual workflow designer may be used immediately as designed or customized to fit business priorities. A completely extensible and editable solution, modified Syxsense Cortex Jobs may be instantly shared and run from the cloud solution.

Get the Job Template

The Cortex Covid Readiness Job template is included with Syxsense Secure at no additional cost. Syxsense is offering free, fully-featured trials for up to 100 devices for 14 days.

More information on the software and trial can be found here.

Experience the Power of Syxsense

Start a trial of Syxsense, which helps organizations from 100 to 100,000 endpoints secure and manage their environment, all from just a web browser.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 18, 2021
Love0
||

Vulnerability Scanning vs. Penetration Testing: What’s the Difference?

By NewsNo Comments

Vulnerability Scanning vs. Penetration Testing: What’s the Difference?

While vulnerability scanning finds potential vulnerabilities, penetration testing takes a different approach. What are the key differences?

The Difference Between Vulnerability Scanning and Penetration Testing

There is often confusion about the purpose of vulnerability scanning compared to penetration testing. Stated simply, vulnerability scanning deals with finding potential vulnerabilities, while penetration testing attempts to exploit them.

Both play an important role in the fight against cyberattacks. Numbers tracked by Kaspersky Lab show an average of close to a billion attacks per quarter launched globally from around 200 different countries. Investigators found more than 100 million unique URLs recognized to be malicious, as well as hundreds of thousands of attempted infections by malware, either designed to steal money via online access to bank accounts, or to shut down data access and demand a ransom.

In the mobile area, as many as a million malicious installation packages are being detected each quarter. These statistics highlight the importance of both vulnerability scanning and penetration testing.

Vulnerability Scanning

Vulnerability scanning deals with inspection of potential exploitation areas to identify vulnerabilities. Regular scans detect and classify system weaknesses. In some cases, the application offers predictions about the effectiveness of countermeasures. Scans can be performed by the IT department or via a managed service. Typically, scans are done against a database of information about known security holes in services and ports, as well as anomalies in packet construction, missing patches, and paths that may exist to exploitable programs or scripts.

Some vulnerability scanners detect vulnerabilities and suggest possible remedies. Others attempt remediation and mitigation across the environment. Some provide strong support for audits and compliance via reporting, or are geared towards security standards such as PCI DSS, Sarbanes-Oxley, or HIPAA. Others specialize in the discovery of web-based holes or problems with authentication credentials, key-based authentication, and credential vaults.

Penetration Testing

Penetration testing is quite different from vulnerability scanning. Pen testing is about exploiting vulnerabilities rather than indicating where potential vulnerabilities may lie.

The vast majority of security incidents are due to attackers taking advantage of known software bugs. In other words, the security hole or bug is known, a patch has been issued, yet the organization has failed to take advantage of it. A lack of regular patching, a failure to inventory endpoints, or the illegal download of rogue applications, provide hackers with an avenue of entry.

It’s no wonder, then, that pen testing tools have emerged to help developers test code by checking it against known vulnerabilities and security holes. They are also used to audit organizations for security compliance, and to unearth problems lurking within the enterprise.

However, there is no single way to conduct such testing. Some scan ports, others scan for Wi-Fi vulnerabilities. Some test applications, others focus on the potential web encroachments. It is common for such tools to use lists of known vulnerabilities and problems. They probe in those areas to see if they can breach the defenses. Most organizations utilize multiple pen testing tools, both proprietary and freeware, rather than relying on a single solution.

Vulnerability Scanning by Syxsense

Syxsense Secure is a comprehensive vulnerability scanner that includes IT management and patch management in one console. It not only shows you what’s wrong, but also deploys the solution.

Gain visibility into OS and third-party vulnerabilities like defects, errors, or misconfigurations of components, while increasing cyber resilience with automated patching and security scans.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 17, 2021
Love0
||

Microsoft Releases Out-of-Band Updates for Windows 10

By News, Patch Management, Patch TuesdayNo Comments

Microsoft Releases Out-of-Band Updates for Windows 10

Microsoft has released out-of-band updates which should be deployed to resolve last week's Blue-Screen-of-Death (BSOD) issues.

Microsoft Issues Updates to Fix Widespread Blue Screen of Death

Last week, Microsoft released their March Patch Tuesday updates to fix 89 security bugs.

Within those updates were several fixes for printers which have caused widespread Blue Screen of Death (BSOD). These have since been recalled.

Those problematic patches include:

  1. KB5000802 Windows 10, version 2004 and 20H2
  2. KB5000808 Windows 10, version 1909
  3. KB5000822 Windows 10, version 1809

KB5000808 Still Offered by Windows Update

Microsoft admitted to the issues and have since released a solution for the problematic update KB500080, replacing it with KB5001566.  Although Microsoft removed this bad patch from SCCM and WSUS, users are still able to download it as part of Windows Update.

To make matters worse, the original problematic update is seen as a ‘Critical’ severity update. It is offered as an automatic install, but the patch released to solve this major printing issue has been released to Windows Update as an ‘Optional’ update. Depending on your settings, this may not update at all.

Out-of-Band Updates

Microsoft released the following out-of-band updates:

  1. KB5001567 Windows 10 Version 2004 and 20H2
  2. KB5001566 Windows 10 Version 1909
  3. KB5001568 Windows 10 Version 1809 (Enterprise/Education/LTSC)
  4. KB5001565 Windows 10 Version 1803 (Enterprise/Education)

How Syxsense Can Help

Syxsense remains committed to assisting customers who have been effected by this BSOD disruption. We have left the uninstaller within the Syxsense Secure console so these updates can be uninstalled.

However until Microsoft addresses the issues above, the content will not be available for public deployment.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 17, 2021
Love0
||

Google Rushes Out Fix for Weaponized Chrome Zero-Day

By Patch ManagementNo Comments

Google Chrome Zero-Day Being Weaponized

A new Chrome vulnerability allows a remote attacker to create a webpage, trick the victim into visiting it, and execute arbitrary code.

Google Warns of New Zero-Day

Google has released Chrome_v89.0.4389.90 to the Stable Channel for Windows, Linux and Mac OS, fixing a total of 8 vulnerabilities. Google has released three zero-day versions of Chrome this year.

The vulnerability exists due to a use-after-free error within Blink component in Google Chrome. A remote attacker can create a specially crafted webpage, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

How to Resolve the Chrome Zero-Day

Upgrade to the latest version of Chrome_v89.0.4389.90 or later using Syxsense Secure.

Syxscore Risk Alert

This vulnerability has a significant risk as this can be exposed over any network, with low complexity and without privileges. Although the latest CVE carries a CVSS score of 8.4 (High Severity), the vulnerability is being weaponized.

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope (Jump Point): No

Start a Free Trial of Syxsense

Experience the power of Syxsense for free. Our intuitive technology helps you easily predict and remove security threats where you are most vulnerable — at the endpoint.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 17, 2021
Love0
||

Exchange Server Hack Reveals the Importance of Patch Management

By NewsNo Comments

Exchange Server Hack Reveals the Importance of Patch Management

Microsoft released an emergency patch on March 2 to plug four security holes in Exchange Server with zero-day exploits continuing.

Exchange Server Hack Shows Why Patch Management Matters

Patch management can never be taken for granted. Yet it appears that many organizations are doing just that.

Microsoft released an emergency patch on March 2 to plug four security holes in Exchange Server. Zero-day attacks exploited these gaps to siphon off emails traffic. Yet despite the existence of the patch and publicity surrounding it, Microsoft continues to see multiple actors taking advantage of unpatched systems one week later. Clearly, patch management is not being given sufficient priority by these IT teams.

In some ways, it may be like the night sentries of old. Some feel asleep at four in the morning and didn’t notice the bad guys jumping the walls. But in the majority of cases, the sentries simply became inattentive. After many hours, days, weeks of walking back and forth along the parapet, they become certain that nothing would ever happen. They stopped looking. Their eyes glazed over and they mechanically paced along, no longer vigilant for any hint of danger, no matter how fleeing – until that fateful day when the castle was stormed on their watch.

Patch Management Vigilance

With Microsoft continuing to advise companies to patch Exchange Server, it appears that those looking after patch management inside some organizations have lost their sense of vigilance and urgency. Perhaps this vital Microsoft patch is sitting in a queue behind another dozen patches that need to be applied.

Perhaps some IT emergency has taken precedence. Perhaps the person dealing with patch management is on vacation. Whatever the excuse, every day without that Exchange patch raises the chances of bad actors getting inside, But then, they may well be there already, quietly infiltrating email accounts and snooping around for financials or confidential files.

Microsoft is so worried about the threat that it has issued a feed of observed indicators of compromise (IOCs) as well as information about various fixes, the details of the attack, and the threat actors involved. Beyond that, it goes without saying that the Exchange patch needs to be implemented immediately.

Organizational barriers to accomplishing this should be removed at once. Systems should be thoroughly checked for any evidence of possible compromise. And organizations should add more rigor to patch management processes. There is no place for complacency when it comes to prioritizing and installing updates and patches to fix gaping security holes.

How Syxsense Can Help

Within Syxsense, we take urgent patches very seriously. Our team evaluates, tests, prioritizes, and releases patches into our patch management system within three hours of issuance by the vendor. This leads the industry. It’s not uncommon for competitors to take many days to accomplish the same thing.

Syxsense Secure provides the technology, the automation, the processes, and the timeliness you need to stay up to date on patches, while also taking care of vulnerability scanning and IT management functions.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 13, 2021
Love0
|

Watch the Webcast: March Patch Tuesday

By Patch Tuesday, VideoNo Comments

Watch the Webcast: March Patch Tuesday

Watch this week's webcast to hear IT industry experts discuss strategies for tackling Microsoft's Patch Tuesday updates.

Watch the March Patch Tuesday 2021 Webcast

Watch our webcast to hear industry experts discuss each of this month’s bulletins and show you strategies for tackling the most important updates.

Our team of IT management experts has deployed over 100 million patches. Sign up for our free webinar to receive the top patch strategies of the month.

View the Webcast

What You Need to Know: March Patch Tuesday

Experience the Power of Syxsense

Syxsense has created innovative and intuitive technology that sees and knows everything. Manage and secure your environment with a simple and powerful solution.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 11, 2021
Love0
|||

Microsoft Confirms New Blue Screen of Death (BSOD) Crashes

By News, Patch TuesdayNo Comments

Microsoft Confirms New Blue Screen of Death (BSOD) Crashes

Following the latest Patch Tuesday, Microsoft has confirmed that Windows 10 devices might crash with a Blue Screen of Death (BSOD).

BSOD Crashes Caused By New Windows 10 Updates

Microsoft released three Windows 10 patches to resolve critical bugs as part of their monthly Patch Tuesday release. These patches have been tested by Syxsense, and following our release process, we observed issues where Blue Screens of Death (BSOD) may occur.

This has been witnessed independently and Microsoft has released an emergency notice. The alert states that an issue has been identified when printing in win32kfull.sys and may impact different printer manufacturers.

The following patches are impacted:

  1. KB5000802 Windows 10, version 2004 and 20H2
  2. KB5000808 Windows 10, version 1909
  3. KB5000822 Windows 10, version 1809

What You Should Do

Syxsense remains committed to assist customers who have been effected by this BSOD disruption and have left the uninstaller within the console so these updates can be uninstalled, however until Microsoft addresses the issues above, the content will not be available for public deployment.

Start Your Free Trial of Syxsense

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 11, 2021
Love0
||

March Patch Tuesday 2021 Addresses 89 Security Fixes

By Patch Management, Patch TuesdayNo Comments

March Patch Tuesday 2021 Addresses 89 Security Fixes

March Patch Tuesday 2021 has officially arrived — tackle the latest Microsoft updates and vulnerabilities for this month.

Microsoft Fixes 89 Bugs this Month, Including Critical IE Fix

There are 14 critical and 75 important fixes this month. This includes updates for Windows, Azure and Azure DevOps, Azure Sphere, Internet Explorer and Edge (EdgeHTML), Exchange Server, Office and Office Services and Web Apps, SharePoint Server, Visual Studio, and Windows Hyper-V.

Year 2 Extended Support – Windows 7 and Windows Server 2008 (including R2) also received updates:

  • Windows 7 – 5 Important vulnerabilities fixed, with the most important one fixing an issue with pending print jobs which remain in an error state.
  • Windows 2008 R2 – 1 Critical and 8 Important vulnerabilities fixed, with the worst impacting DNS as per our recommendation below.

“Today is the last scheduled release of patches for legacy Windows Edge, and going forward this will become an obsolete browser,” said Robert Brown, Head of Customer Success for Syxsense. “ You must upgrade to the newest Microsoft Edge browser which uses the new Chromium engine, similar to Mozilla and Google Chrome.”

For next month, the only updates for Microsoft Edge will be for the Chromium version. We have also seen a very serious weaponized issue fixed with Internet Explorer which has not been patched for almost four months.

Top March Patches and Vulnerabilities

Based on the Vendor Severity and CVSS Score, we have made a few recommendations below. As usual, we recommend entering the CVE numbers below into your patch management solution and deploying as soon as possible.

1. CVE-2021-26411: Internet Explorer Memory Corruption Vulnerability

An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and convince a user to view the website. Additionally, the attacker could also take advantage of compromised websites, or ones that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability.

However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 8.8
  • Weaponised: Yes
  • Public Aware: Yes
  • Countermeasure: No

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: Required
  • Scope (Jump Point): Yes

2. CVE-2021-26867: Hyper-V Remote Code Execution Vulnerability

Microsoft Windows Hyper-V could allow a remote authenticated attacker to execute arbitrary code on the system. By executing a specially-crafted program on a Hyper-V guest, an attacker could exploit this vulnerability to execute arbitrary code on the host operating system.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 9.9
  • Weaponised: No
  • Public Aware: No
  • Countermeasure: Hyper-V client which is configured to use the Plan 9 file system, under Linux.

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: Low
  • User Interaction: None
  • Scope (Jump Point): Yes

3. CVE-2021-26897: Windows DNS Server Remote Code Execution Vulnerability

The vulnerability exists due to improper input validation in the Windows DNS Server. A remote attacker can send a specially-crafted request and execute arbitrary code on the target system which if success may result in complete compromise of vulnerable system.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 9.8
  • Weaponised: No
  • Public Aware: No
  • Countermeasure: Some – DNS server would need to have dynamic updates enabled.

Syxscore Risk Alert

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): No

[vc_single_image image=”38151″ img_size=”full” onclick=”custom_link” link=”https://www.syxsense.com/start-a-free-trial-of-syxsense/”]

Syxsense Recommendations

Based on the vendor severity and CVSS Score, we have made a few recommendations below which you should prioritize this month. Please pay close attention to any of these which are publicly aware or weaponized.

 

CVE Title Vendor Severity CVSS Score Publicly Aware Weaponised Countermeasure Syxsense Recommended
CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability Critical 9.1 No Yes No Yes
CVE-2021-26411 Internet Explorer Memory Corruption Vulnerability Critical 8.8 Yes Yes No Yes
CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability Critical 7.8 No Yes No Yes
CVE-2021-27065 Microsoft Exchange Server Remote Code Execution Vulnerability Critical 7.8 No Yes No Yes
CVE-2021-26858 Microsoft Exchange Server Remote Code Execution Vulnerability Important 7.8 No Yes No Yes
CVE-2021-26867 Windows Hyper-V Remote Code Execution Vulnerability Critical 9.9 No No Yes Yes
CVE-2021-26897 Windows DNS Server Remote Code Execution Vulnerability Critical 9.8 No No Yes Yes
CVE-2021-26877 Windows DNS Server Remote Code Execution Vulnerability Important 9.8 No No No Yes
CVE-2021-26893 Windows DNS Server Remote Code Execution Vulnerability Important 9.8 No No No Yes
CVE-2021-26894 Windows DNS Server Remote Code Execution Vulnerability Important 9.8 No No No Yes
CVE-2021-26895 Windows DNS Server Remote Code Execution Vulnerability Important 9.8 No No No Yes
CVE-2021-27080 Azure Sphere Unsigned Code Execution Vulnerability Critical 9.3 No No No Yes
CVE-2021-26412 Microsoft Exchange Server Remote Code Execution Vulnerability Critical 9.1 No No No Yes
CVE-2021-27078 Microsoft Exchange Server Remote Code Execution Vulnerability Important 9.1 No No No Yes
CVE-2021-21300 Git for Visual Studio Remote Code Execution Vulnerability Critical 8.8 No No No Yes
CVE-2021-26876 OpenType Font Parsing Remote Code Execution Vulnerability Critical 8.8 No No No Yes
CVE-2021-27085 Internet Explorer Remote Code Execution Vulnerability Important 8.8 No No No Yes
CVE-2021-27076 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No No Yes
CVE-2021-26865 Windows Container Execution Agent Elevation of Privilege Vulnerability Important 8.8 No No No Yes
CVE-2021-26864 Windows Virtual Registry Provider Elevation of Privilege Vulnerability Important 8.4 No No No Yes
CVE-2021-27077 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 Yes No No Yes
CVE-2021-24089 HEVC Video Extensions Remote Code Execution Vulnerability Critical 7.8 No No No Yes
CVE-2021-26902 HEVC Video Extensions Remote Code Execution Vulnerability Critical 7.8 No No No Yes
CVE-2021-27061 HEVC Video Extensions Remote Code Execution Vulnerability Critical 7.8 No No No Yes
CVE-2021-27074 Azure Sphere Unsigned Code Execution Vulnerability Critical 6.2 No No No Yes
CVE-2021-26890 Application Virtualization Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24110 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27047 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27048 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27049 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27050 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27051 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27062 HEVC Video Extensions Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27053 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27054 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27058 Microsoft Office ClickToRun Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-24108 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27057 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27056 Microsoft PowerPoint Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26887 Microsoft Windows Folder Redirection Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-27082 Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26882 Remote Access API Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-27083 Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26880 Storage Spaces Controller Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-27081 Visual Studio Code ESLint Extension Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-27060 Visual Studio Code Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26860 Windows App-V Overlay Filter Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26891 Windows Container Execution Agent Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-24090 Windows Error Reporting Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26872 Windows Event Tracing Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26898 Windows Event Tracing Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26901 Windows Event Tracing Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26868 Windows Graphics Component Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26861 Windows Graphics Component Remote Code Execution Vulnerability Important 7.8 No No No
CVE-2021-26874 Windows Overlay Filter Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-1640 Windows Print Spooler Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26878 Windows Print Spooler Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26870 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26899 Windows UPnP Device Host Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26871 Windows Wallet Service Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26885 Windows Wallet Service Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26875 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26900 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No No
CVE-2021-26859 Microsoft Power BI Information Disclosure Vulnerability Important 7.7 No No No
CVE-2021-27059 Microsoft Office Remote Code Execution Vulnerability Important 7.6 No No No
CVE-2021-26881 Microsoft Windows Media Foundation Remote Code Execution Vulnerability Important 7.5 No No No
CVE-2021-26896 Windows DNS Server Denial of Service Vulnerability Important 7.5 No No No
CVE-2021-27063 Windows DNS Server Denial of Service Vulnerability Important 7.5 No No No
CVE-2021-26879 Windows NAT Denial of Service Vulnerability Important 7.5 No No No
CVE-2021-27070 Windows 10 Update Assistant Elevation of Privilege Vulnerability Important 7.3 No No No
CVE-2021-26866 Windows Update Service Elevation of Privilege Vulnerability Important 7.1 No No No
CVE-2021-26889 Windows Update Stack Elevation of Privilege Vulnerability Important 7.1 No No No
CVE-2021-1729 Windows Update Stack Setup Elevation of Privilege Vulnerability Important 7.1 No No No
CVE-2021-24095 DirectX Elevation of Privilege Vulnerability Important 7 No No No
CVE-2021-27055 Microsoft Visio Security Feature Bypass Vulnerability Important 7 No No No
CVE-2021-26873 Windows User Profile Service Elevation of Privilege Vulnerability Important 7 No No No
CVE-2021-26863 Windows Win32k Elevation of Privilege Vulnerability Important 7 No No No
CVE-2021-27075 Azure Virtual Machine Information Disclosure Vulnerability Important 6.8 No No No
CVE-2021-26854 Microsoft Exchange Server Remote Code Execution Vulnerability Important 6.6 No No No
CVE-2021-26862 Windows Installer Elevation of Privilege Vulnerability Important 6.3 No No No
CVE-2021-26892 Windows Extensible Firmware Interface Security Feature Bypass Vulnerability Important 6.2 No No No
CVE-2021-26886 User Profile Service Denial of Service Vulnerability Important 5.5 No No No
CVE-2021-26869 Windows ActiveX Installer Service Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-24107 Windows Event Tracing Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-26884 Windows Media Photo Codec Information Disclosure Vulnerability Important 5.5 No No No
CVE-2021-27052 Microsoft SharePoint Server Information Disclosure Vulnerability Important 5.3 No No No
CVE-2021-24104 Microsoft SharePoint Spoofing Vulnerability Important 4.6 No No No
CVE-2021-27066 Windows Admin Center Security Feature Bypass Vulnerability Important 4.3 No No No
CVE-2021-27084 Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability Important NA No No No

 

Experience the Power of Syxsense

Syxsense is a cloud-based solution that helps organizations manage and secure their endpoints with ease. Automatically deploy OS and third-party patches as well as Windows 10 Feature Updates for Microsoft, Mac, and Linux devices.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
March 10, 2021
Love0