cyware: Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs

Summary: This content provides a list of security vulnerabilities and their severity levels in various Microsoft products and services.

Threat Actor: N/A

Victim: N/A

Key Point:

  • The content highlights multiple security vulnerabilities in Microsoft products and services, including .NET and Visual Studio, Azure, Azure AI Search, Azure Arc, Azure Compute Gallery, Azure Migrate, Azure Monitor, Azure Private 5G Core, Azure SDK, Intel, Internet Shortcut Files, Mariner, Microsoft Azure Kubernetes Service, Microsoft Brokering File System, Microsoft Defender for IoT, Microsoft Edge (Chromium-based), Microsoft Install Service, Microsoft Office Excel, Microsoft Office Outlook, Microsoft Office SharePoint, Microsoft WDAC ODBC Driver, Microsoft WDAC OLE DB provider for SQL, Role: DNS Server, Role: Windows Hyper-V, SQL Server, Windows Authentication Methods, Windows BitLocker, Windows Compressed Folder, Windows Cryptographic Services, Windows Defender Credential Guard, Windows DHCP Server, Windows Distributed File System (DFS), Windows DWM Core Library, Windows File Server Resource Management Service, Windows HTTP.sys, Windows Internet Connection Sharing (ICS), Windows Kerberos, Windows Kernel, Windows Local Security Authority Subsystem Service (LSASS), Windows Message Queuing, Windows Mobile Hotspot, Windows Proxy Driver, Windows Remote Access Connection Manager, Windows Remote Procedure Call, Windows Routing and Remote Access Service (RRAS), Windows Secure Boot, Windows Storage, Windows Telephony Server, Windows Update Stack, Windows USB Print Driver, and Windows Virtual Machine Bus.
  • The vulnerabilities range in severity from Low to Critical.
TagCVE IDCVE TitleSeverity.NET and Visual StudioCVE-2024-21409.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityImportantAzureCVE-2024-29993Azure CycleCloud Elevation of Privilege VulnerabilityImportantAzure AI SearchCVE-2024-29063Azure AI Search Information Disclosure VulnerabilityImportantAzure ArcCVE-2024-28917Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege VulnerabilityImportantAzure Compute GalleryCVE-2024-21424Azure Compute Gallery Elevation of Privilege VulnerabilityImportantAzure MigrateCVE-2024-26193Azure Migrate Remote Code Execution VulnerabilityImportantAzure MonitorCVE-2024-29989Azure Monitor Agent Elevation of Privilege VulnerabilityImportantAzure Private 5G CoreCVE-2024-20685Azure Private 5G Core Denial of Service VulnerabilityModerateAzure SDKCVE-2024-29992Azure Identity Library for .NET Information Disclosure VulnerabilityModerateIntelCVE-2024-2201Intel: CVE-2024-2201 Branch History InjectionImportantInternet Shortcut FilesCVE-2024-29988SmartScreen Prompt Security Feature Bypass VulnerabilityImportantMarinerCVE-2019-3816UnknownUnknownMarinerCVE-2019-3833UnknownUnknownMicrosoft Azure Kubernetes ServiceCVE-2024-29990Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege VulnerabilityImportantMicrosoft Brokering File SystemCVE-2024-28905Microsoft Brokering File System Elevation of Privilege VulnerabilityImportantMicrosoft Brokering File SystemCVE-2024-28907Microsoft Brokering File System Elevation of Privilege VulnerabilityImportantMicrosoft Brokering File SystemCVE-2024-26213Microsoft Brokering File System Elevation of Privilege VulnerabilityImportantMicrosoft Brokering File SystemCVE-2024-28904Microsoft Brokering File System Elevation of Privilege VulnerabilityImportantMicrosoft Defender for IoTCVE-2024-29055Microsoft Defender for IoT Elevation of Privilege VulnerabilityImportantMicrosoft Defender for IoTCVE-2024-29053Microsoft Defender for IoT Remote Code Execution VulnerabilityCriticalMicrosoft Defender for IoTCVE-2024-29054Microsoft Defender for IoT Elevation of Privilege VulnerabilityImportantMicrosoft Defender for IoTCVE-2024-21324Microsoft Defender for IoT Elevation of Privilege VulnerabilityImportantMicrosoft Defender for IoTCVE-2024-21323Microsoft Defender for IoT Remote Code Execution VulnerabilityCriticalMicrosoft Defender for IoTCVE-2024-21322Microsoft Defender for IoT Remote Code Execution VulnerabilityCriticalMicrosoft Edge (Chromium-based)CVE-2024-3156Chromium: CVE-2024-3156 Inappropriate implementation in V8UnknownMicrosoft Edge (Chromium-based)CVE-2024-29049Microsoft Edge (Chromium-based) Webview2 Spoofing VulnerabilityModerateMicrosoft Edge (Chromium-based)CVE-2024-29981Microsoft Edge (Chromium-based) Spoofing VulnerabilityLowMicrosoft Edge (Chromium-based)CVE-2024-3159Chromium: CVE-2024-3159 Out of bounds memory access in V8UnknownMicrosoft Edge (Chromium-based)CVE-2024-3158Chromium: CVE-2024-3158 Use after free in BookmarksUnknownMicrosoft Install ServiceCVE-2024-26158Microsoft Install Service Elevation of Privilege VulnerabilityImportantMicrosoft Office ExcelCVE-2024-26257Microsoft Excel Remote Code Execution VulnerabilityImportantMicrosoft Office OutlookCVE-2024-20670Outlook for Windows Spoofing VulnerabilityImportantMicrosoft Office SharePointCVE-2024-26251Microsoft SharePoint Server Spoofing VulnerabilityImportantMicrosoft WDAC ODBC DriverCVE-2024-26214Microsoft WDAC SQL Server ODBC Driver Remote Code Execution VulnerabilityImportantMicrosoft WDAC OLE DB provider for SQLCVE-2024-26244Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportantMicrosoft WDAC OLE DB provider for SQLCVE-2024-26210Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26233Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26231Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26227Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26223Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26221Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26224Windows DNS Server Remote Code Execution VulnerabilityImportantRole: DNS ServerCVE-2024-26222Windows DNS Server Remote Code Execution VulnerabilityImportantRole: Windows Hyper-VCVE-2024-29064Windows Hyper-V Denial of Service VulnerabilityImportantSQL ServerCVE-2024-28937Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28938Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29044Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28935Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28940Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28943Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28941Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28910Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28944Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28908Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28909Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29985Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28906Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28926Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28933Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28934Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28927Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28930Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29046Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28932Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29047Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28931Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29984Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28929Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28939Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28942Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29043Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28936Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29045Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28915Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28913Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28945Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29048Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28912Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28914Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29983Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-28911Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantSQL ServerCVE-2024-29982Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityImportantWindows Authentication MethodsCVE-2024-29056Windows Authentication Elevation of Privilege VulnerabilityImportantWindows Authentication MethodsCVE-2024-21447Windows Authentication Elevation of Privilege VulnerabilityImportantWindows BitLockerCVE-2024-20665BitLocker Security Feature Bypass VulnerabilityImportantWindows Compressed FolderCVE-2024-26256libarchive Remote Code Execution VulnerabilityImportantWindows Cryptographic ServicesCVE-2024-26228Windows Cryptographic Services Security Feature Bypass VulnerabilityImportantWindows Cryptographic ServicesCVE-2024-29050Windows Cryptographic Services Remote Code Execution VulnerabilityImportantWindows Defender Credential GuardCVE-2024-26237Windows Defender Credential Guard Elevation of Privilege VulnerabilityImportantWindows DHCP ServerCVE-2024-26212DHCP Server Service Denial of Service VulnerabilityImportantWindows DHCP ServerCVE-2024-26215DHCP Server Service Denial of Service VulnerabilityImportantWindows DHCP ServerCVE-2024-26195DHCP Server Service Remote Code Execution VulnerabilityImportantWindows DHCP ServerCVE-2024-26202DHCP Server Service Remote Code Execution VulnerabilityImportantWindows Distributed File System (DFS)CVE-2024-29066Windows Distributed File System (DFS) Remote Code Execution VulnerabilityImportantWindows Distributed File System (DFS)CVE-2024-26226Windows Distributed File System (DFS) Information Disclosure VulnerabilityImportantWindows DWM Core LibraryCVE-2024-26172Windows DWM Core Library Information Disclosure VulnerabilityImportantWindows File Server Resource Management ServiceCVE-2024-26216Windows File Server Resource Management Service Elevation of Privilege VulnerabilityImportantWindows HTTP.sysCVE-2024-26219HTTP.sys Denial of Service VulnerabilityImportantWindows Internet Connection Sharing (ICS)CVE-2024-26253Windows rndismp6.sys Remote Code Execution VulnerabilityImportantWindows Internet Connection Sharing (ICS)CVE-2024-26252Windows rndismp6.sys Remote Code Execution VulnerabilityImportantWindows KerberosCVE-2024-26183Windows Kerberos Denial of Service VulnerabilityImportantWindows KerberosCVE-2024-26248Windows Kerberos Elevation of Privilege VulnerabilityImportantWindows KernelCVE-2024-20693Windows Kernel Elevation of Privilege VulnerabilityImportantWindows KernelCVE-2024-26245Windows SMB Elevation of Privilege VulnerabilityImportantWindows KernelCVE-2024-26229Windows CSC Service Elevation of Privilege VulnerabilityImportantWindows KernelCVE-2024-26218Windows Kernel Elevation of Privilege VulnerabilityImportantWindows Local Security Authority Subsystem Service (LSASS)CVE-2024-26209Microsoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityImportantWindows Message QueuingCVE-2024-26232Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityImportantWindows Message QueuingCVE-2024-26208Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityImportantWindows Mobile HotspotCVE-2024-26220Windows Mobile Hotspot Information Disclosure VulnerabilityImportantWindows Proxy DriverCVE-2024-26234Proxy Driver Spoofing VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-28902Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-28900Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-28901Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26255Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26230Windows Telephony Server Elevation of Privilege VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26239Windows Telephony Server Elevation of Privilege VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26207Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26217Windows Remote Access Connection Manager Information Disclosure VulnerabilityImportantWindows Remote Access Connection ManagerCVE-2024-26211Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityImportantWindows Remote Procedure CallCVE-2024-20678Remote Procedure Call Runtime Remote Code Execution VulnerabilityImportantWindows Routing and Remote Access Service (RRAS)CVE-2024-26200Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityImportantWindows Routing and Remote Access Service (RRAS)CVE-2024-26179Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityImportantWindows Routing and Remote Access Service (RRAS)CVE-2024-26205Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityImportantWindows Secure BootCVE-2024-29061Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28921Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-20689Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26250Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28922Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-29062Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-20669Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28898Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-20688Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-23593Lenovo: CVE-2024-23593 Zero Out Boot Manager and drop to UEFI ShellImportantWindows Secure BootCVE-2024-28896Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28919Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-23594Lenovo: CVE-2024-23594 Stack Buffer Overflow in LenovoBT.efiImportantWindows Secure BootCVE-2024-28923Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28903Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26189Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26240Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28924Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28897Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28925Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26175Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-28920Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26194Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26180Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26171Secure Boot Security Feature Bypass VulnerabilityImportantWindows Secure BootCVE-2024-26168Secure Boot Security Feature Bypass VulnerabilityImportantWindows StorageCVE-2024-29052Windows Storage Elevation of Privilege VulnerabilityImportantWindows Telephony ServerCVE-2024-26242Windows Telephony Server Elevation of Privilege VulnerabilityImportantWindows Update StackCVE-2024-26236Windows Update Stack Elevation of Privilege VulnerabilityImportantWindows Update StackCVE-2024-26235Windows Update Stack Elevation of Privilege VulnerabilityImportantWindows USB Print DriverCVE-2024-26243Windows USB Print Driver Elevation of Privilege VulnerabilityImportantWindows Virtual Machine BusCVE-2024-26254Microsoft Virtual Machine Bus (VMBus) Denial of Service VulnerabilityImportantWindows Win32K – ICOMPCVE-2024-26241Win32k Elevation of Privilege VulnerabilityImportant

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2024-patch-tuesday-fixes-150-security-flaws-67-rces/


“An interesting youtube video that may be related to the article above”