CVE Vulnerability Advisory Database

[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)

[Impact] Remote unauthenticated attackers can bypass authentication via identity spoofing and execute arbitrary commands with system privileges

[Mitigation] Immediately upgrade to version 25.1.3.0 or later and perform a comprehensive compromise assessment using official IoCs

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component

[Impact] Unauthorized remote attackers can bypass security warnings to perform network-based spoofing, potentially leading to credential harvesting or malware delivery

[Mitigation] Apply the official Microsoft security updates immediately and restrict outbound SMB/WebDAV traffic

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] An unauthenticated remote attacker can exploit improper input validation (CWE-20) over the network to perform spoofing, potentially leading to unauthorized data exposure and modification

[Mitigation] Immediately apply the official security updates provided by Microsoft, and implement WAF rules to monitor and block anomalous HTTP requests in the interim

[Affected Scope] On-premises deployments of Microsoft SharePoint Server

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms to perform network-based spoofing, potentially accessing sensitive internal data

[Mitigation] Immediately apply the official Microsoft security updates and restrict external network access to SharePoint web ports

[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol

[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks

[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic

[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems

[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks

[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls

[Affected Scope] All supported versions of Windows client and server operating systems utilizing the MSHTML (Internet Explorer) engine.

[Impact] Attackers can bypass security warnings and spoof trusted domains to steal sensitive credentials or execute malicious payloads by tricking users into visiting crafted web content.

[Mitigation] Immediately apply the October 2024 Microsoft cumulative security updates and restrict MSHTML execution via registry hardening.

[Affected Scope] All supported versions of Microsoft Windows client and server operating systems utilizing the MSHTML platform

[Impact] Attackers can spoof file extensions to trick users into executing malicious payloads, leading to potential Remote Code Execution (RCE)

[Mitigation] Apply the Microsoft September 2024 cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] MSHTML (Internet Explorer) engine embedded in all supported versions of Windows 10, 11, and Windows Server

[Impact] Attackers can bypass security warnings via specially crafted Internet Shortcut (.url) files, leading to arbitrary code execution and complete system compromise

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .url and .lnk files

[Affected Scope] Windows and Windows Server operating systems, specifically Active Directory Domain Controllers

[Impact] Unauthenticated remote attackers can call methods on the LSARPC interface to coerce the Domain Controller to authenticate to an arbitrary target via NTLM, leading to full domain takeover

[Mitigation] Apply the official Microsoft cumulative security updates immediately, and enforce Extended Protection for Authentication (EPA) along with SMB signing to block NTLM relay paths

[Affected Scope] Systems running Microsoft Windows with App Installer (AppX/MSIX) and the ms-appinstaller URI scheme enabled

[Impact] Successful exploitation allows threat actors to deliver malware families such as Emotet, Trickbot, and Bazaloader via phishing, leading to complete system compromise.

[Mitigation] Apply the latest official Windows App Installer updates and disable the ms-appinstaller protocol handler via Group Policy.