Security News > 2024 > April > Microsoft squashes SmartScreen security bypass bug exploited in the wild
Patch Tuesday Microsoft fixed 149 security flaws in its own products this week, and while Redmond acknowledged one of those vulnerabilities is being actively exploited, we've been told another hole is under attack, too.
Trend Micro's Zero Day Initiative says a separate vulnerability, spotted and reported by bug hunter Peter Girrus, was under attack in the wild before Microsoft issued a patch this week.
Let's start with the bug ZDI categorizes as being under exploit in the wild.
This one is a SmartScreen prompt security feature bypass vulnerability tracked as CVE-2024-29988, and it received an 8.8 out of 10 CVSS severity rating.
Assuming an attacker can fool someone into clicking on a malicious link or opening a malware-laden file, the bug allows them to bypass the SmartScreen security feature in Windows that's supposed to alert users to any untrusted websites or other threats.
There's a whopping 12 CVEs in Experience Manager, and the patches resolve "Important" flaws that could result in arbitrary code execution and security feature bypass.
News URL
https://go.theregister.com/feed/www.theregister.com/2024/04/10/april_patch_tuesday/
Related news
- Azure Service Tags tagged as security risk, Microsoft disagrees (source)
- Microsoft shows venerable and vulnerable NTLM security protocol the door (source)
- Microsoft delays Windows Recall amid privacy and security concerns (source)
- Microsoft Delays AI-Powered Recall Feature for Copilot+ PCs Amid Security Concerns (source)
- Microsoft delays Windows Recall rollout, more security testing needed (source)
- Microsoft answered Congress' questions on security. Now the White House needs to act (source)
- Microsoft: New Outlook security changes coming to personal accounts (source)
- Snowblind malware abuses Android security feature to bypass security (source)
- Microsoft hits snooze again on security certificate renewal (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-04-09 | CVE-2024-29988 | Unspecified vulnerability in Microsoft products SmartScreen Prompt Security Feature Bypass Vulnerability | 8.8 |