Microsoft identity acronyms—what do they mean and how do they relate to each other?

As a security advisor working with one to three Chief Information Security Officers CISOs each week, the topic of identity comes up often. These are smart people who have often been in industry for decades. They have their own vocabulary of acronyms that only security professionals know such as...

February 25, 2020—KB4537795 (OS Build 17134.1345)

None None...

February 25, 2020—KB4537818 (OS Build 17763.1075)

None None...

January 28, 2020—KB4532695 (OS Builds 18362.628 and 18363.628)

None None...

January 23, 2020—KB4534308 (OS Build 17134.1276)

None None...

DEBIAN-CVE-2019-17023

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox 72...

ALPINE-CVE-2019-17023

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox 72...

CVE-2019-19782

The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server...

Go passwordless to strengthen security and reduce costs

We all know passwords are inherently unsecure. They’re also expensive to manage. Users struggle to remember them. It’s why we’re so passionate about eliminating passwords entirely. Passwordless solutions, such as Windows Hello, FIDO2 security keys, and the Microsoft Authenticator app, provide mor...

Microsoft Releases Security Advisory for Windows Hello for Business

Microsoft has released a Security Advisory to address an issue in Windows Hello for Business WHfB. An attacker could exploit this issue on devices that were affected by CVE-2017-15361, also known as Return of Coppersmith’s Attack ROCA, to take control of an affected system. The Cybersecurity and...

hellomagazine.com Improper Access Control vulnerability

Security Researcher geeknik Helped patch 8584 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting hellomagazine.com website and its users. Following...

Microsoft Guidance for cleaning up orphaned keys generated on vulnerable TPMs and used for Windows Hello for Business

Microsoft is aware of an issue in Windows Hello for Business WHfB with public keys that persist after a device is removed from Active Directory, if the AD exists. After a user sets up Windows Hello for Business WHfB, the WHfB public key is written to the on-premises Active Directory. The WHfB key...

KLA11699 Windows Hello for Business Security update

After a user sets up Windows Hello for Business WHfB, the WHfB public key is written to the on-premises Active Directory. The WHfB keys are tied to a user and a device that has been added to Azure AD, and if the device is removed, the corresponding WHfB key is considered orphaned. However, these...

DEBIAN-CVE-2019-15699

An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 TLS 1.2 packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of t...

August 19, 2019—KB4512509 (OS Build 17134.984)

None None...

August 17, 2019—KB4512534 (OS Build 17763.720)

None None...

July 26, 2019—KB4505903 (OS Build 18362.267)

None None...

June 27, 2019—KB4501375 (OS Build 18362.207)

None None...

Advancing Windows 10 as a passwordless platform

Passwords can be frustrating, difficult to remember, and easily hacked or stolen. That’s why our vision for Windows is one of a passwordless platform—a world where users don’t have to deal with the pains of a password. With the release of Windows 10, version 1903, we’re bringing Windows 10 closer...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL...