Microsoft Patch Tuesday — Oct. 2019: Vulnerability disclosures and Snort coverage

2019-10-08T10:11:15

Description

[![](https://3.bp.blogspot.com/-bIERk6jqSvs/XKypl8tltSI/AAAAAAAAFxU/d9l6_EW1Czs7DzBngmhg8pjdPfhPAZ3yACK4BGAYYCw/s1600/recurring%2Bblog%2Bimages_patch%2Btuesday.jpg)](<http://3.bp.blogspot.com/-bIERk6jqSvs/XKypl8tltSI/AAAAAAAAFxU/d9l6_EW1Czs7DzBngmhg8pjdPfhPAZ3yACK4BGAYYCw/s1600/recurring%2Bblog%2Bimages_patch%2Btuesday.jpg>) _By Jon Munshaw._ Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The [latest Patch Tuesday](<https://portal.msrc.microsoft.com/en-us/security-guidance>) discloses 60 vulnerabilities, nine of which are considered "critical," with the rest being deemed "important." This month’s security update covers security issues in a variety of Microsoft services and software, the Chakra Scripting Engine, the Windows operating system and the SharePoint software. Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post [here](<https://blog.snort.org/2019/10/snort-rule-update-for-oct-8-2019.html>). ### Critical vulnerabilities Microsoft disclosed nine critical vulnerabilities this month, eight of which we will highlight below. [CVE-2019-1333](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0712>) is a client-side remote execution vulnerability in Remote Desktop Services (RDP) that occurs when a user visits a malicious server. An attacker could exploit this vulnerability by having control of a malicious server, and then convincing the user to connect to it — likely via social engineering or a man-in-the-middle attack. An attacker could also compromise a legitimate server and then host malicious code on it, waiting for a user to connect. If successful, the attacker could gain the ability to remotely execute code on the victim machine that connected to the server. [CVE-2019-1238](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1238>) and [CVE-2019-1239](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239>) are remote code execution vulnerabilities that exist in the way VBScript handles objects in memory. These bugs all could lead to memory corruption in a way that would allow an attacker to execute arbitrary code on the victim machine. An attacker could exploit these vulnerabilities by tricking a user into visiting a specially crafted, malicious website through Internet Explorer. They could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that utilizes the Internet Explorer rendering engine. [CVE-2019-1307](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1307>), [CVE-2019-1308](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1308>), [CVE-2019-1335](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1335>) and [CVE-2019-1366](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1366>) are all memory corruption vulnerabilities in the Chakra Scripting Engine inside of the Microsoft Edge web browser. An attacker could use these bugs to corrupt memory on the victim machine in a way that would allow them to remotely execute arbitrary code. A user could trigger these vulnerabilities by visiting a specially crafted, malicious website in Edge. [CVE-2019-1372](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372>) is an elevation of privilege vulnerability on Azure Stack when the Azure App Service fails to properly check the length of a buffer prior to copying memory to it. An attacker could exploit this vulnerability to copy any function run by the user, thereby executing code in the context of NT AUTHORITY/system, which could allow the attacker to escape a sandbox. There is also [CVE-2019-1060](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1060>), a remote code execution vulnerability in Microsoft XML Core Services. ### Important vulnerabilities This release also contains 51 important vulnerabilities. * [CVE-2019-0608](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608>) * [CVE-2019-1070](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1070>) * [CVE-2019-1166](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1166>) * [CVE-2019-1230](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1230>) * [CVE-2019-1311](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1311>) * [CVE-2019-1313](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1313>) * [CVE-2019-1314](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1314>) * [CVE-2019-1315](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1315>) * [CVE-2019-1316](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1316>) * [CVE-2019-1317](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1317>) * [CVE-2019-1318](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1318>) * [CVE-2019-1319](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1319>) * [CVE-2019-1320](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1320>) * [CVE-2019-1321](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1321>) * [CVE-2019-1322](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1322>) * [CVE-2019-1323](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1323>) * [CVE-2019-1325](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1325>) * [CVE-2019-1326](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1326>) * [CVE-2019-1327](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1327>) * [CVE-2019-1328](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1328>) * [CVE-2019-1329](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1329>) * [CVE-2019-1330](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1330>) * [CVE-2019-1331](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1331>) * [CVE-2019-1334](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1334>) * [CVE-2019-1336](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1336>) * [CVE-2019-1337](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1337>) * [CVE-2019-1338](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1338>) * [CVE-2019-1339](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1339>) * [CVE-2019-1340](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1340>) * [CVE-2019-1341](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1341>) * [CVE-2019-1342](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1342>) * [CVE-2019-1343](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1343>) * [CVE-2019-1344](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1344>) * [CVE-2019-1345](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1345>) * [CVE-2019-1346](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1346>) * [CVE-2019-1347](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1347>) * [CVE-2019-1356](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1356>) * [CVE-2019-1357](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1357>) * [CVE-2019-1358](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1358>) * [CVE-2019-1359](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1359>) * [CVE-2019-1361](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1361>) * [CVE-2019-1362](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1362>) * [CVE-2019-1363](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1363>) * [CVE-2019-1364](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1364>) * [CVE-2019-1365](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365>) * [CVE-2019-1368](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1368>) * [CVE-2019-1369](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1369>) * [CVE-2019-1371](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1371>) * [CVE-2019-1375](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1375>) * [CVE-2019-1376](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1376>) * [CVE-2019-1378](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1378>) ### Coverage In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org. These rules are: 51733 - 51736, 51739 - 51742, 51781 - 51794 ![](http://feeds.feedburner.com/~r/feedburner/Talos/~4/5gWDxm3fpIE)

{"id": "TALOSBLOG:3052A7B74E1E13F630CF51AB1B1A36D6", "type": "talosblog", "bulletinFamily": "blog", "title": "Microsoft Patch Tuesday \u2014 Oct. 2019: Vulnerability disclosures and Snort coverage", "description": "[![](https://3.bp.blogspot.com/-bIERk6jqSvs/XKypl8tltSI/AAAAAAAAFxU/d9l6_EW1Czs7DzBngmhg8pjdPfhPAZ3yACK4BGAYYCw/s1600/recurring%2Bblog%2Bimages_patch%2Btuesday.jpg)](<http://3.bp.blogspot.com/-bIERk6jqSvs/XKypl8tltSI/AAAAAAAAFxU/d9l6_EW1Czs7DzBngmhg8pjdPfhPAZ3yACK4BGAYYCw/s1600/recurring%2Bblog%2Bimages_patch%2Btuesday.jpg>) \n \n \n \n \n \n \n \n \n \n \n_By Jon Munshaw._ \n \nMicrosoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The [latest Patch Tuesday](<https://portal.msrc.microsoft.com/en-us/security-guidance>) discloses 60 vulnerabilities, nine of which are considered \"critical,\" with the rest being deemed \"important.\" \n \nThis month\u2019s security update covers security issues in a variety of Microsoft services and software, the Chakra Scripting Engine, the Windows operating system and the SharePoint software. \n \nTalos also released a new set of SNORT\u24c7 rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post [here](<https://blog.snort.org/2019/10/snort-rule-update-for-oct-8-2019.html>). \n \n\n\n### Critical vulnerabilities\n\nMicrosoft disclosed nine critical vulnerabilities this month, eight of which we will highlight below. \n \n[CVE-2019-1333](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0712>) is a client-side remote execution vulnerability in Remote Desktop Services (RDP) that occurs when a user visits a malicious server. An attacker could exploit this vulnerability by having control of a malicious server, and then convincing the user to connect to it \u2014 likely via social engineering or a man-in-the-middle attack. An attacker could also compromise a legitimate server and then host malicious code on it, waiting for a user to connect. If successful, the attacker could gain the ability to remotely execute code on the victim machine that connected to the server. \n \n[CVE-2019-1238](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1238>) and [CVE-2019-1239](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239>) are remote code execution vulnerabilities that exist in the way VBScript handles objects in memory. These bugs all could lead to memory corruption in a way that would allow an attacker to execute arbitrary code on the victim machine. An attacker could exploit these vulnerabilities by tricking a user into visiting a specially crafted, malicious website through Internet Explorer. They could also embed an ActiveX control marked \"safe for initialization\" in an application or Microsoft Office document that utilizes the Internet Explorer rendering engine. \n \n[CVE-2019-1307](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1307>), [CVE-2019-1308](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1308>), [CVE-2019-1335](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1335>) and [CVE-2019-1366](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1366>) are all memory corruption vulnerabilities in the Chakra Scripting Engine inside of the Microsoft Edge web browser. An attacker could use these bugs to corrupt memory on the victim machine in a way that would allow them to remotely execute arbitrary code. A user could trigger these vulnerabilities by visiting a specially crafted, malicious website in Edge. \n \n[CVE-2019-1372](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372>) is an elevation of privilege vulnerability on Azure Stack when the Azure App Service fails to properly check the length of a buffer prior to copying memory to it. An attacker could exploit this vulnerability to copy any function run by the user, thereby executing code in the context of NT AUTHORITY/system, which could allow the attacker to escape a sandbox. \n \nThere is also [CVE-2019-1060](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1060>), a remote code execution vulnerability in Microsoft XML Core Services. \n\n\n### Important vulnerabilities\n\nThis release also contains 51 important vulnerabilities. \n\n\n * [CVE-2019-0608](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608>)\n * [CVE-2019-1070](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1070>)\n * [CVE-2019-1166](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1166>)\n * [CVE-2019-1230](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1230>)\n * [CVE-2019-1311](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1311>)\n * [CVE-2019-1313](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1313>)\n * [CVE-2019-1314](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1314>)\n * [CVE-2019-1315](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1315>)\n * [CVE-2019-1316](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1316>)\n * [CVE-2019-1317](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1317>)\n * [CVE-2019-1318](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1318>)\n * [CVE-2019-1319](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1319>)\n * [CVE-2019-1320](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1320>)\n * [CVE-2019-1321](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1321>)\n * [CVE-2019-1322](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1322>)\n * [CVE-2019-1323](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1323>)\n * [CVE-2019-1325](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1325>)\n * [CVE-2019-1326](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1326>)\n * [CVE-2019-1327](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1327>)\n * [CVE-2019-1328](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1328>)\n * [CVE-2019-1329](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1329>)\n * [CVE-2019-1330](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1330>)\n * [CVE-2019-1331](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1331>)\n * [CVE-2019-1334](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1334>)\n * [CVE-2019-1336](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1336>)\n * [CVE-2019-1337](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1337>)\n * [CVE-2019-1338](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1338>)\n * [CVE-2019-1339](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1339>)\n * [CVE-2019-1340](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1340>)\n * [CVE-2019-1341](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1341>)\n * [CVE-2019-1342](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1342>)\n * [CVE-2019-1343](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1343>)\n * [CVE-2019-1344](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1344>)\n * [CVE-2019-1345](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1345>)\n * [CVE-2019-1346](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1346>)\n * [CVE-2019-1347](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1347>)\n * [CVE-2019-1356](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1356>)\n * [CVE-2019-1357](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1357>)\n * [CVE-2019-1358](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1358>)\n * [CVE-2019-1359](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1359>)\n * [CVE-2019-1361](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1361>)\n * [CVE-2019-1362](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1362>)\n * [CVE-2019-1363](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1363>)\n * [CVE-2019-1364](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1364>)\n * [CVE-2019-1365](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365>)\n * [CVE-2019-1368](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1368>)\n * [CVE-2019-1369](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1369>)\n * [CVE-2019-1371](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1371>)\n * [CVE-2019-1375](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1375>)\n * [CVE-2019-1376](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1376>)\n * [CVE-2019-1378](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1378>)\n\n### Coverage \n\nIn response to these vulnerability disclosures, Talos is releasing a new SNORT\u24c7 rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org. \n \nThese rules are: 51733 - 51736, 51739 - 51742, 51781 - 51794\n\n![](http://feeds.feedburner.com/~r/feedburner/Talos/~4/5gWDxm3fpIE)", "published": "2019-10-08T10:11:15", "modified": "2019-10-08T10:11:15", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "http://feedproxy.google.com/~r/feedburner/Talos/~3/5gWDxm3fpIE/microsoft-patch-tuesday-oct-2019.html", "reporter": "noreply@blogger.com (Jon Munshaw)", "references": [], "cvelist": ["CVE-2019-0608", "CVE-2019-0712", "CVE-2019-1060", "CVE-2019-1070", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1313", "CVE-2019-1314", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1327", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1361", "CVE-2019-1362", "CVE-2019-1363", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1369", "CVE-2019-1371", "CVE-2019-1372", "CVE-2019-1375", "CVE-2019-1376", "CVE-2019-1378"], "lastseen": "2019-10-17T09:31:12", "viewCount": 106, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:367AA182-5494-4ED5-B6C9-2746D4EB33BB", "AKB:8011789D-8681-4C89-A088-8E14D395987F", "AKB:90C542D1-EDD5-471A-AD1F-9A040CD78976", "AKB:EAFD84D0-4944-48E1-A3F2-8BEDB7998862"]}, {"type": "canvas", "idList": ["ERROR_REPORTING_LPE"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2019-1302", "CPAI-2019-1303", "CPAI-2019-1304", "CPAI-2019-1305", "CPAI-2019-1306", "CPAI-2019-1343", "CPAI-2019-1344", "CPAI-2019-1345", "CPAI-2019-1346", "CPAI-2019-1349", "CPAI-2019-1350", "CPAI-2019-1861", "CPAI-2019-1974", "CPAI-2019-2129", "CPAI-2019-2136"]}, {"type": "cisa", "idList": ["CISA:60BECD302CACD014F496544254DCB720"]}, {"type": "cve", "idList": ["CVE-2019-0608", "CVE-2019-0712", "CVE-2019-1060", "CVE-2019-1070", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1309", "CVE-2019-1310", "CVE-2019-1311", "CVE-2019-1313", "CVE-2019-1314", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1327", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1361", "CVE-2019-1362", "CVE-2019-1363", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1369", "CVE-2019-1371", "CVE-2019-1372", "CVE-2019-1375", "CVE-2019-1376", "CVE-2019-1378", "CVE-2019-1399"]}, {"type": "exploitdb", "idList": ["EDB-ID:47684", "EDB-ID:47805", "EDB-ID:48149"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:35553BEFF42A94A5A731E9C926E550DD", "EXPLOITPACK:EC837ED1EA41395DFCD50B526170B177"]}, {"type": "github", "idList": ["GHSA-2WWC-W2GW-4329", "GHSA-6J89-JHPR-849F", "GHSA-P23J-G745-8449", "GHSA-VW2G-5827-M9FP"]}, {"type": "githubexploit", "idList": ["9AB93B24-2B91-51C7-815D-64FBDC990049", "A954EF44-14A7-5992-87BC-C327FBBD385A"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:C2A64C2133DFD2ACB457C2DD2790CBF7"]}, {"type": "ibm", "idList": ["DB866DC8DC23646847AE5E9E25C02B2DF2A195A414B2734DCAA102E637957BAF"]}, {"type": "kaspersky", "idList": ["KLA11574", "KLA11575", "KLA11576", "KLA11577", "KLA11578", "KLA11608", "KLA11643", "KLA11654", "KLA11655", "KLA11871", "KLA11872"]}, {"type": "kitploit", "idList": ["KITPLOIT:3386831261888925588", "KITPLOIT:3701426813255055656", "KITPLOIT:4761268611976240701"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-WINDOWS-LOCAL-COMAHAWK-"]}, {"type": "mscve", "idList": ["MS:CVE-2019-0608", "MS:CVE-2019-0712", "MS:CVE-2019-1060", "MS:CVE-2019-1070", "MS:CVE-2019-1166", "MS:CVE-2019-1230", "MS:CVE-2019-1238", "MS:CVE-2019-1239", "MS:CVE-2019-1307", "MS:CVE-2019-1308", "MS:CVE-2019-1311", "MS:CVE-2019-1313", "MS:CVE-2019-1314", "MS:CVE-2019-1315", "MS:CVE-2019-1316", "MS:CVE-2019-1317", "MS:CVE-2019-1318", "MS:CVE-2019-1319", "MS:CVE-2019-1320", "MS:CVE-2019-1321", "MS:CVE-2019-1322", "MS:CVE-2019-1323", "MS:CVE-2019-1325", "MS:CVE-2019-1326", "MS:CVE-2019-1327", "MS:CVE-2019-1328", "MS:CVE-2019-1329", "MS:CVE-2019-1330", "MS:CVE-2019-1331", "MS:CVE-2019-1333", "MS:CVE-2019-1334", "MS:CVE-2019-1335", "MS:CVE-2019-1336", "MS:CVE-2019-1337", "MS:CVE-2019-1338", "MS:CVE-2019-1339", "MS:CVE-2019-1340", "MS:CVE-2019-1341", "MS:CVE-2019-1342", "MS:CVE-2019-1343", "MS:CVE-2019-1344", "MS:CVE-2019-1345", "MS:CVE-2019-1346", "MS:CVE-2019-1347", "MS:CVE-2019-1356", "MS:CVE-2019-1357", "MS:CVE-2019-1358", "MS:CVE-2019-1359", "MS:CVE-2019-1361", "MS:CVE-2019-1362", "MS:CVE-2019-1363", "MS:CVE-2019-1364", "MS:CVE-2019-1365", "MS:CVE-2019-1366", "MS:CVE-2019-1368", "MS:CVE-2019-1369", "MS:CVE-2019-1371", "MS:CVE-2019-1372", "MS:CVE-2019-1375", "MS:CVE-2019-1376", "MS:CVE-2019-1378"]}, {"type": "mskb", "idList": ["KB4462176", "KB4462215", "KB4475554", "KB4475558", "KB4475569", "KB4475595", "KB4475608", "KB4484110", "KB4484111", "KB4484112", "KB4484122", "KB4484123", "KB4484130", "KB4484131", "KB4515519", "KB4517388", "KB4517389", "KB4519335", "KB4519336", "KB4519337", "KB4519338", "KB4519764", "KB4519765", "KB4519974", "KB4519976", "KB4519985", "KB4519990", "KB4519998", "KB4520002", "KB4520003", "KB4520004", "KB4520005", "KB4520007", "KB4520008", "KB4520009", "KB4520010", "KB4520011", "KB4524964"]}, {"type": "nessus", "idList": ["SMB_NT_MS19_NOV_4523205.NASL", "SMB_NT_MS19_NOV_4524570.NASL", "SMB_NT_MS19_NOV_4525232.NASL", "SMB_NT_MS19_NOV_4525234.NASL", "SMB_NT_MS19_NOV_4525235.NASL", "SMB_NT_MS19_NOV_4525236.NASL", "SMB_NT_MS19_NOV_4525237.NASL", "SMB_NT_MS19_NOV_4525241.NASL", "SMB_NT_MS19_NOV_4525243.NASL", "SMB_NT_MS19_NOV_4525246.NASL", "SMB_NT_MS19_OCT_4517389.NASL", "SMB_NT_MS19_OCT_4519338.NASL", "SMB_NT_MS19_OCT_4519976.NASL", "SMB_NT_MS19_OCT_4519998.NASL", "SMB_NT_MS19_OCT_4520002.NASL", "SMB_NT_MS19_OCT_4520004.NASL", "SMB_NT_MS19_OCT_4520005.NASL", "SMB_NT_MS19_OCT_4520007.NASL", "SMB_NT_MS19_OCT_4520008.NASL", "SMB_NT_MS19_OCT_4520010.NASL", "SMB_NT_MS19_OCT_4520011.NASL", "SMB_NT_MS19_OCT_EXCEL.NASL", "SMB_NT_MS19_OCT_EXCEL_C2R.NASL", "SMB_NT_MS19_OCT_INTERNET_EXPLORER.NASL", "SMB_NT_MS19_OCT_MICROSOFT_DYNAMICS.NASL", "SMB_NT_MS19_OCT_OFFICE.NASL", "SMB_NT_MS19_OCT_OFFICE_C2R.NASL", "SMB_NT_MS19_OCT_OFFICE_SHAREPOINT.NASL", "SMB_NT_MS19_OCT_OFFICE_WEB.NASL", "SMB_NT_MS19_OCT_SSMS.NASL", "WEB_APPLICATION_SCANNING_112328", "WEB_APPLICATION_SCANNING_112329", "WEB_APPLICATION_SCANNING_112330"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310815486", "OPENVAS:1361412562310815487", "OPENVAS:1361412562310815488", "OPENVAS:1361412562310815489", "OPENVAS:1361412562310815490", "OPENVAS:1361412562310815492", "OPENVAS:1361412562310815493", "OPENVAS:1361412562310815494", "OPENVAS:1361412562310815497", "OPENVAS:1361412562310815635", "OPENVAS:1361412562310815636", "OPENVAS:1361412562310815637", "OPENVAS:1361412562310815704", "OPENVAS:1361412562310815705", "OPENVAS:1361412562310815706", "OPENVAS:1361412562310815707", "OPENVAS:1361412562310815708", "OPENVAS:1361412562310815710", "OPENVAS:1361412562310815720", "OPENVAS:1361412562310815722", "OPENVAS:1361412562310815834", "OPENVAS:1361412562310815835", "OPENVAS:1361412562310815836", "OPENVAS:1361412562310815837", "OPENVAS:1361412562310815839"]}, {"type": "osv", "idList": ["OSV:GHSA-2WWC-W2GW-4329", "OSV:GHSA-6J89-JHPR-849F", "OSV:GHSA-P23J-G745-8449", "OSV:GHSA-VW2G-5827-M9FP"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:155723", "PACKETSTORM:156588"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:22507355C87630C1D3B720E2ED98701A", "QUALYSBLOG:36145D374BE8B413181362F0BD4A4907"]}, {"type": "symantec", "idList": ["SMNTC-110225", "SMNTC-110226", "SMNTC-110227", "SMNTC-110228", "SMNTC-110229", "SMNTC-110230", "SMNTC-110231", "SMNTC-110232", "SMNTC-110233", "SMNTC-110234", "SMNTC-110235", "SMNTC-110237", "SMNTC-110238", "SMNTC-110239", "SMNTC-110244", "SMNTC-110246", "SMNTC-110247", "SMNTC-110248", "SMNTC-110249", "SMNTC-110250", "SMNTC-110251", "SMNTC-110252", "SMNTC-110253", "SMNTC-110254", "SMNTC-110255", "SMNTC-110256", "SMNTC-110257", "SMNTC-110258", "SMNTC-110259", "SMNTC-110261", "SMNTC-110262", "SMNTC-110263", "SMNTC-110264", "SMNTC-110265", "SMNTC-110266", "SMNTC-110267", "SMNTC-110268", "SMNTC-110269", "SMNTC-110270", "SMNTC-110271", "SMNTC-110272", "SMNTC-110273", "SMNTC-110278", "SMNTC-110279", "SMNTC-110282", "SMNTC-110283", "SMNTC-110288", "SMNTC-110290", "SMNTC-110293", "SMNTC-110295", "SMNTC-110303", "SMNTC-110304", "SMNTC-110305", "SMNTC-110306", "SMNTC-110307", "SMNTC-110310", "SMNTC-110338", "SMNTC-110340", "SMNTC-110341", "SMNTC-110342", "SMNTC-110691"]}, {"type": "talosblog", "idList": ["TALOSBLOG:C3F889D9C3C954C42160A3C26034C2F6", "TALOSBLOG:D617C7EFD22C4CD2ECFE1B030BD80B0E", "TALOSBLOG:F543D5FEAB2BB1C90B9699F8AE8757F4"]}, {"type": "thn", "idList": ["THN:0C7E84207B4D65E7F360B825BEC52DF5", "THN:8DCF845D1AC9E7107BDC3A4BCA6D2723"]}, {"type": "threatpost", "idList": ["THREATPOST:D22DCF190C71B12772E59B68DFA9CCD0"]}, {"type": "veracode", "idList": ["VERACODE:21677", "VERACODE:21678", "VERACODE:21680", "VERACODE:21683"]}, {"type": "zdi", "idList": ["ZDI-19-867", "ZDI-19-868", "ZDI-19-869", "ZDI-19-966"]}, {"type": "zdt", "idList": ["1337DAY-ID-33360", "1337DAY-ID-33361", "1337DAY-ID-33362", "1337DAY-ID-33363", "1337DAY-ID-33364", "1337DAY-ID-33365", "1337DAY-ID-33566", "1337DAY-ID-33685"]}]}, "score": {"value": 1.1, "vector": "NONE"}, "backreferences": {"references": [{"type": "attackerkb", "idList": ["AKB:8011789D-8681-4C89-A088-8E14D395987F"]}, {"type": "canvas", "idList": ["ERROR_REPORTING_LPE"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2019-1302", "CPAI-2019-1303", "CPAI-2019-1304", "CPAI-2019-1305", "CPAI-2019-1306", "CPAI-2019-1343", "CPAI-2019-1344", "CPAI-2019-1345", "CPAI-2019-1346", "CPAI-2019-1349", "CPAI-2019-1350", "CPAI-2019-1861", "CPAI-2019-1974", "CPAI-2019-2129", "CPAI-2019-2136"]}, {"type": "cisa", "idList": ["CISA:60BECD302CACD014F496544254DCB720"]}, {"type": "cve", "idList": ["CVE-2019-0608", "CVE-2019-0712", "CVE-2019-1060", "CVE-2019-1070", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1313", "CVE-2019-1314", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1327", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1361", "CVE-2019-1362", "CVE-2019-1363", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1369", "CVE-2019-1371", "CVE-2019-1372", "CVE-2019-1375", "CVE-2019-1376", "CVE-2019-1378"]}, {"type": "exploitdb", "idList": ["EDB-ID:47684", "EDB-ID:47805"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:EC837ED1EA41395DFCD50B526170B177"]}, {"type": "github", "idList": ["GHSA-2WWC-W2GW-4329", "GHSA-6J89-JHPR-849F", "GHSA-P23J-G745-8449", "GHSA-VW2G-5827-M9FP"]}, {"type": "githubexploit", "idList": ["9AB93B24-2B91-51C7-815D-64FBDC990049", "A954EF44-14A7-5992-87BC-C327FBBD385A"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:C2A64C2133DFD2ACB457C2DD2790CBF7"]}, {"type": "kaspersky", "idList": ["KLA11574", "KLA11575", "KLA11576", "KLA11577", "KLA11578", "KLA11608", "KLA11643", "KLA11654", "KLA11655", "KLA11871", "KLA11872"]}, {"type": "kitploit", "idList": ["KITPLOIT:3386831261888925588", "KITPLOIT:3701426813255055656"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT/WINDOWS/LOCAL/COMAHAWK"]}, {"type": "mscve", "idList": ["MS:CVE-2019-0608", "MS:CVE-2019-0712", "MS:CVE-2019-1060", "MS:CVE-2019-1070", "MS:CVE-2019-1166", "MS:CVE-2019-1230", "MS:CVE-2019-1238", "MS:CVE-2019-1239", "MS:CVE-2019-1307", "MS:CVE-2019-1311", "MS:CVE-2019-1313", "MS:CVE-2019-1314", "MS:CVE-2019-1315", "MS:CVE-2019-1316", "MS:CVE-2019-1317", "MS:CVE-2019-1319", "MS:CVE-2019-1321", "MS:CVE-2019-1325", "MS:CVE-2019-1328", "MS:CVE-2019-1329", "MS:CVE-2019-1330", "MS:CVE-2019-1331", "MS:CVE-2019-1333", "MS:CVE-2019-1334", "MS:CVE-2019-1335", "MS:CVE-2019-1336", "MS:CVE-2019-1337", "MS:CVE-2019-1338", "MS:CVE-2019-1339", "MS:CVE-2019-1340", "MS:CVE-2019-1341", "MS:CVE-2019-1342", "MS:CVE-2019-1343", "MS:CVE-2019-1344", "MS:CVE-2019-1345", "MS:CVE-2019-1346", "MS:CVE-2019-1347", "MS:CVE-2019-1356", "MS:CVE-2019-1357", "MS:CVE-2019-1358", "MS:CVE-2019-1359", "MS:CVE-2019-1362", "MS:CVE-2019-1363", "MS:CVE-2019-1364", "MS:CVE-2019-1365", "MS:CVE-2019-1366", "MS:CVE-2019-1369", "MS:CVE-2019-1372", "MS:CVE-2019-1375", "MS:CVE-2019-1376", "MS:CVE-2019-1378"]}, {"type": "mskb", "idList": ["KB4519990", "KB4520004"]}, {"type": "nessus", "idList": ["SMB_NT_MS19_NOV_4523205.NASL", "SMB_NT_MS19_NOV_4524570.NASL", "SMB_NT_MS19_NOV_4525232.NASL", "SMB_NT_MS19_NOV_4525234.NASL", "SMB_NT_MS19_NOV_4525235.NASL", "SMB_NT_MS19_NOV_4525236.NASL", "SMB_NT_MS19_NOV_4525237.NASL", "SMB_NT_MS19_NOV_4525241.NASL", "SMB_NT_MS19_NOV_4525243.NASL", "SMB_NT_MS19_NOV_4525246.NASL", "SMB_NT_MS19_OCT_4520007.NASL", "SMB_NT_MS19_OCT_MICROSOFT_DYNAMICS.NASL", "SMB_NT_MS19_OCT_SSMS.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310815486", "OPENVAS:1361412562310815487", "OPENVAS:1361412562310815488", "OPENVAS:1361412562310815489", "OPENVAS:1361412562310815490", "OPENVAS:1361412562310815492", "OPENVAS:1361412562310815493", "OPENVAS:1361412562310815494", "OPENVAS:1361412562310815497", "OPENVAS:1361412562310815635", "OPENVAS:1361412562310815636", "OPENVAS:1361412562310815637", "OPENVAS:1361412562310815704", "OPENVAS:1361412562310815705", "OPENVAS:1361412562310815706", "OPENVAS:1361412562310815707", "OPENVAS:1361412562310815708", "OPENVAS:1361412562310815710", "OPENVAS:1361412562310815720", "OPENVAS:1361412562310815722", "OPENVAS:1361412562310815834", "OPENVAS:1361412562310815835", "OPENVAS:1361412562310815836", "OPENVAS:1361412562310815837", "OPENVAS:1361412562310815839"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:155723"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:36145D374BE8B413181362F0BD4A4907"]}, {"type": "symantec", "idList": ["SMNTC-110267"]}, {"type": "talosblog", "idList": ["TALOSBLOG:C3F889D9C3C954C42160A3C26034C2F6", "TALOSBLOG:D617C7EFD22C4CD2ECFE1B030BD80B0E", "TALOSBLOG:F543D5FEAB2BB1C90B9699F8AE8757F4"]}, {"type": "thn", "idList": ["THN:8DCF845D1AC9E7107BDC3A4BCA6D2723"]}, {"type": "threatpost", "idList": ["THREATPOST:D22DCF190C71B12772E59B68DFA9CCD0"]}, {"type": "zdi", "idList": ["ZDI-19-867", "ZDI-19-868", "ZDI-19-966"]}, {"type": "zdt", "idList": ["1337DAY-ID-33360", "1337DAY-ID-33361", "1337DAY-ID-33362", "1337DAY-ID-33363", "1337DAY-ID-33364", "1337DAY-ID-33365", "1337DAY-ID-33566", "1337DAY-ID-33685"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2019-0608", "epss": "0.000850000", "percentile": "0.343770000", "modified": "2023-03-14"}, {"cve": "CVE-2019-0712", "epss": "0.001170000", "percentile": "0.438960000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1060", "epss": "0.025860000", "percentile": "0.886070000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1070", "epss": "0.000680000", "percentile": "0.275100000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1166", "epss": "0.093200000", "percentile": "0.936900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1230", "epss": "0.003400000", "percentile": "0.668360000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1238", "epss": "0.007440000", "percentile": "0.779860000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1239", "epss": "0.011360000", "percentile": "0.825120000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1307", "epss": "0.012140000", "percentile": "0.831250000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1308", "epss": "0.012140000", "percentile": "0.831250000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1311", "epss": "0.011820000", "percentile": "0.828730000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1313", "epss": "0.001930000", "percentile": "0.553350000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1314", "epss": "0.000670000", "percentile": "0.274060000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1315", "epss": "0.007420000", "percentile": "0.779480000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1316", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1317", "epss": "0.001170000", "percentile": "0.438830000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1318", "epss": "0.002700000", "percentile": "0.627160000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1319", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1320", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1321", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1322", "epss": "0.000440000", "percentile": "0.079780000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1323", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1325", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1326", "epss": "0.001930000", "percentile": "0.552660000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1327", "epss": "0.037990000", "percentile": "0.904520000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1328", "epss": "0.000530000", "percentile": "0.191030000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1329", "epss": "0.000520000", "percentile": "0.181620000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1330", "epss": "0.000640000", "percentile": "0.259880000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1331", "epss": "0.037990000", "percentile": "0.904520000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1333", "epss": "0.037990000", "percentile": "0.904520000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1334", "epss": "0.000490000", "percentile": "0.154450000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1335", "epss": "0.012140000", "percentile": "0.831250000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1336", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1337", "epss": "0.000490000", "percentile": "0.154450000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1338", "epss": "0.235320000", "percentile": "0.957900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1339", "epss": "0.000710000", "percentile": "0.290090000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1340", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1341", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1342", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1343", "epss": "0.004110000", "percentile": "0.698510000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1344", "epss": "0.000420000", "percentile": "0.056950000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1345", "epss": "0.000420000", "percentile": "0.056950000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1346", "epss": "0.004430000", "percentile": "0.709160000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1347", "epss": "0.004430000", "percentile": "0.709160000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1356", "epss": "0.333590000", "percentile": "0.963510000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1357", "epss": "0.000850000", "percentile": "0.343770000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1358", "epss": "0.011820000", "percentile": "0.828730000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1359", "epss": "0.011820000", "percentile": "0.828730000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1361", "epss": "0.001440000", "percentile": "0.485410000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1362", "epss": "0.000820000", "percentile": "0.333220000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1363", "epss": "0.000490000", "percentile": "0.154450000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1364", "epss": "0.000450000", "percentile": "0.124430000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1365", "epss": "0.001820000", "percentile": "0.536720000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1366", "epss": "0.012140000", "percentile": "0.831250000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1368", "epss": "0.000670000", "percentile": "0.274060000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1369", "epss": "0.000490000", "percentile": "0.154450000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1371", "epss": "0.012140000", "percentile": "0.831250000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1372", "epss": "0.103610000", "percentile": "0.940290000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1375", "epss": "0.000520000", "percentile": "0.181620000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1376", "epss": "0.001930000", "percentile": "0.553350000", "modified": "2023-03-14"}, {"cve": "CVE-2019-1378", "epss": "0.000430000", "percentile": "0.073900000", "modified": "2023-03-14"}], "vulnersScore": 1.1}, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1660004461, "score": 1659956764, "epss": 1678884476}, "_internal": {"score_hash": "ecdc82484912eeeba2a86be5e5cf540d"}}

{"nessus": [{"lastseen": "2023-03-17T15:17:55", "description": "The remote Windows host is missing security update 4520008.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way Windows handles authentication requests. (CVE-2019-1320, CVE-2019-1322)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality. An attacker who successfully exploited this vulnerability could disclose protected kernel memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL). An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520008: Windows 10 Version 1803 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4520008.NASL", "href": "https://www.tenable.com/plugins/nessus/129724", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129724);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1230\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1320\",\n \"CVE-2019-1321\",\n \"CVE-2019-1322\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1339\",\n \"CVE-2019-1340\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1366\",\n \"CVE-2019-1368\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520008\");\n script_xref(name:\"MSFT\", value:\"MS19-4520008\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520008: Windows 10 Version 1803 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520008.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in\n Windows AppX Deployment Server that allows file creation\n in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the\n Windows Hyper-V Network Switch on a host operating\n system fails to properly validate input from an\n authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows improperly handles authentication requests. An\n attacker who successfully exploited this vulnerability\n could run processes in an elevated context. An attacker\n could exploit this vulnerability by running a specially\n crafted application on the victim system. The update\n addresses the vulnerability by correcting the way\n Windows handles authentication requests. (CVE-2019-1320,\n CVE-2019-1322)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass exists when Windows Secure\n Boot improperly restricts access to debugging\n functionality. An attacker who successfully exploited\n this vulnerability could disclose protected kernel\n memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when\n Windows CloudStore improperly handles file Discretionary\n Access Control List (DACL). An attacker who successfully\n exploited this vulnerability could overwrite a targeted\n file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4520008/windows-10-update-kb4520008\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0ed66c5d\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4520008.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft UPnP Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520008');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"17134\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520008])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:18:59", "description": "The remote Windows host is missing security update 4519338.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1323, CVE-2019-1336)\n\n - An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user\u2019s system. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. (CVE-2019-1356)\n\n - An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way Windows handles authentication requests. (CVE-2019-1320, CVE-2019-1322)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238, CVE-2019-1239)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality. An attacker who successfully exploited this vulnerability could disclose protected kernel memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL). An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could potentially disclose memory contents of an elevated process. (CVE-2019-1337)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4519338: Windows 10 Version 1809 and Windows Server 2019 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4519338.NASL", "href": "https://www.tenable.com/plugins/nessus/129717", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129717);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1230\",\n \"CVE-2019-1238\",\n \"CVE-2019-1239\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1320\",\n \"CVE-2019-1321\",\n \"CVE-2019-1322\",\n \"CVE-2019-1323\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1336\",\n \"CVE-2019-1337\",\n \"CVE-2019-1339\",\n \"CVE-2019-1340\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1356\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1366\",\n \"CVE-2019-1368\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4519338\");\n script_xref(name:\"MSFT\", value:\"MS19-4519338\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4519338: Windows 10 Version 1809 and Windows Server 2019 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4519338.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - An elevation of privilege vulnerability exists in\n Windows AppX Deployment Server that allows file creation\n in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - An elevation of privilege vulnerability exists in the\n Microsoft Windows Update Client when it does not\n properly handle privileges. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. An attacker could then install\n programs; view, change or delete data. (CVE-2019-1323,\n CVE-2019-1336)\n\n - An information disclosure vulnerability exists when \n Microsoft Edge based on Edge HTML improperly handles \n objects in memory. An attacker who successfully exploited \n the vulnerability could obtain information to further \n compromise the user\u00e2\u0080\u0099s system. To exploit the vulnerability, \n in a web-based attack scenario, an attacker could host a \n website in an attempt to exploit the vulnerability. In \n addition, compromised websites and websites that accept \n or host user-provided content could contain specially \n crafted content that could exploit the vulnerability. \n (CVE-2019-1356)\n\n - An information disclosure vulnerability exists when the\n Windows Hyper-V Network Switch on a host operating\n system fails to properly validate input from an\n authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows improperly handles authentication requests. An\n attacker who successfully exploited this vulnerability\n could run processes in an elevated context. An attacker\n could exploit this vulnerability by running a specially\n crafted application on the victim system. The update\n addresses the vulnerability by correcting the way\n Windows handles authentication requests. (CVE-2019-1320,\n CVE-2019-1322)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238, CVE-2019-1239)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass exists when Windows Secure\n Boot improperly restricts access to debugging\n functionality. An attacker who successfully exploited\n this vulnerability could disclose protected kernel\n memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when\n Windows CloudStore improperly handles file Discretionary\n Access Control List (DACL). An attacker who successfully\n exploited this vulnerability could overwrite a targeted\n file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when\n Windows Update Client fails to properly handle objects\n in memory. An attacker who successfully exploited the\n vulnerability could potentially disclose memory contents\n of an elevated process. (CVE-2019-1337)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4519338/windows-10-update-kb4519338\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ef69aa73\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4519338.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft UPnP Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4519338');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"17763\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4519338])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:18:26", "description": "The remote Windows host is missing security update 4520004.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way Windows handles authentication requests. (CVE-2019-1320)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL). An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520004: Windows 10 Version 1709 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1366", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4520004.NASL", "href": "https://www.tenable.com/plugins/nessus/129721", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129721);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1230\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1320\",\n \"CVE-2019-1321\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1339\",\n \"CVE-2019-1340\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1366\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520004\");\n script_xref(name:\"MSFT\", value:\"MS19-4520004\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520004: Windows 10 Version 1709 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520004.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in\n Windows AppX Deployment Server that allows file creation\n in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the\n Windows Hyper-V Network Switch on a host operating\n system fails to properly validate input from an\n authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An elevation of privilege vulnerability exists when\n Windows improperly handles authentication requests. An\n attacker who successfully exploited this vulnerability\n could run processes in an elevated context. An attacker\n could exploit this vulnerability by running a specially\n crafted application on the victim system. The update\n addresses the vulnerability by correcting the way\n Windows handles authentication requests. (CVE-2019-1320)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when\n Windows CloudStore improperly handles file Discretionary\n Access Control List (DACL). An attacker who successfully\n exploited this vulnerability could overwrite a targeted\n file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4520004/windows-10-update-kb4520004\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?60d0b932\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4520004.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1333\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520004');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\nmy_os_build = get_kb_item(\"SMB/WindowsVersionBuild\");\nproductname = get_kb_item_or_exit(\"SMB/ProductName\");\n\nif (my_os_build = \"16299\" && \"enterprise\" >!< tolower(productname) && \"education\" >!< tolower(productname) && \"server\" >!< tolower(productname))\n audit(AUDIT_OS_NOT, \"a supported version of Windows\");\n\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"16299\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520004])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:18:59", "description": "The remote Windows host is missing security update 4520010.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL). An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1321)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319) \n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520010: Windows 10 Version 1703 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1321", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1366", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4520010.NASL", "href": "https://www.tenable.com/plugins/nessus/129725", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129725);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1230\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1321\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1339\",\n \"CVE-2019-1340\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1366\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520010\");\n script_xref(name:\"MSFT\", value:\"MS19-4520010\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520010: Windows 10 Version 1703 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520010.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in\n Windows AppX Deployment Server that allows file creation\n in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists when the\n Windows Hyper-V Network Switch on a host operating\n system fails to properly validate input from an\n authenticated user on a guest operating system.\n (CVE-2019-1230)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when\n Windows CloudStore improperly handles file Discretionary\n Access Control List (DACL). An attacker who successfully\n exploited this vulnerability could overwrite a targeted\n file leading to an elevated status. (CVE-2019-1321)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n \n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4520010/windows-10-update-kb4520010\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?4f0552f5\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4520010.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1333\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520010');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"15063\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520010])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:16:49", "description": "The remote Windows host is missing security update 4520011.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341) \n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520011: Windows 10 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1366", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4520011.NASL", "href": "https://www.tenable.com/plugins/nessus/129726", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129726);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1366\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520011\");\n script_xref(name:\"MSFT\", value:\"MS19-4520011\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520011: Windows 10 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520011.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n \n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4520011/windows-10-update-kb4520011\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8905e062\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4520011.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1333\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520011');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"10240\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520011])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:18:02", "description": "The remote Windows host is missing security update 4517389.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1323, CVE-2019-1336)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way Windows handles authentication requests. (CVE-2019-1320, CVE-2019-1322)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user\u2019s system. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. (CVE-2019-1356)\n\n - A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality. An attacker who successfully exploited this vulnerability could disclose protected kernel memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL). An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could potentially disclose memory contents of an elevated process. (CVE-2019-1337)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319) \n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4517389: Windows 10 Version 1903 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1368", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4517389.NASL", "href": "https://www.tenable.com/plugins/nessus/129716", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129716);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1320\",\n \"CVE-2019-1321\",\n \"CVE-2019-1322\",\n \"CVE-2019-1323\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1336\",\n \"CVE-2019-1337\",\n \"CVE-2019-1339\",\n \"CVE-2019-1340\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1356\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1366\",\n \"CVE-2019-1368\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4517389\");\n script_xref(name:\"MSFT\", value:\"MS19-4517389\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4517389: Windows 10 Version 1903 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4517389.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - An elevation of privilege vulnerability exists in\n Windows AppX Deployment Server that allows file creation\n in arbitrary locations. (CVE-2019-1340)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - An elevation of privilege vulnerability exists in the\n Microsoft Windows Update Client when it does not\n properly handle privileges. An attacker who successfully\n exploited this vulnerability could run processes in an\n elevated context. An attacker could then install\n programs; view, change or delete data. (CVE-2019-1323,\n CVE-2019-1336)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows improperly handles authentication requests. An\n attacker who successfully exploited this vulnerability\n could run processes in an elevated context. An attacker\n could exploit this vulnerability by running a specially\n crafted application on the victim system. The update\n addresses the vulnerability by correcting the way\n Windows handles authentication requests. (CVE-2019-1320,\n CVE-2019-1322)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - An information disclosure vulnerability exists when \n Microsoft Edge based on Edge HTML improperly handles \n objects in memory. An attacker who successfully exploited \n the vulnerability could obtain information to further \n compromise the user\u00e2\u0080\u0099s system. To exploit the vulnerability, \n in a web-based attack scenario, an attacker could host a \n website in an attempt to exploit the vulnerability. In \n addition, compromised websites and websites that accept \n or host user-provided content could contain specially \n crafted content that could exploit the vulnerability. \n (CVE-2019-1356)\n\n - A security feature bypass exists when Windows Secure\n Boot improperly restricts access to debugging\n functionality. An attacker who successfully exploited\n this vulnerability could disclose protected kernel\n memory. (CVE-2019-1368)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists when\n Windows CloudStore improperly handles file Discretionary\n Access Control List (DACL). An attacker who successfully\n exploited this vulnerability could overwrite a targeted\n file leading to an elevated status. (CVE-2019-1321)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when\n Windows Update Client fails to properly handle objects\n in memory. An attacker who successfully exploited the\n vulnerability could potentially disclose memory contents\n of an elevated process. (CVE-2019-1337)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n \n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4517389/windows-10-update-kb4517389\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?13a5b27c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4517389.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft UPnP Local Privilege Elevation Vulnerability');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4517389');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"18362\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4517389])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:18:26", "description": "The remote Windows host is missing security update 4519998.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user\u2019s system. To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. (CVE-2019-1356)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1366)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4519998: Windows 10 Version 1607 and Windows Server 2016 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1335", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1366", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:edge"], "id": "SMB_NT_MS19_OCT_4519998.NASL", "href": "https://www.tenable.com/plugins/nessus/129719", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129719);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1307\",\n \"CVE-2019-1308\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1316\",\n \"CVE-2019-1317\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1335\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1345\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1356\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1366\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4519998\");\n script_xref(name:\"MSFT\", value:\"MS19-4519998\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4519998: Windows 10 Version 1607 and Windows Server 2016 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4519998.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows\n improperly handles hard links. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1317)\n\n - A remote code execution vulnerability exists in the way\n that the Chakra scripting engine handles objects in\n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker\n could execute arbitrary code in the context of the\n current user. An attacker who successfully exploited the\n vulnerability could gain the same user rights as the\n current user. (CVE-2019-1307, CVE-2019-1308, \n CVE-2019-1335)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334, CVE-2019-1345)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - An information disclosure vulnerability exists when \n Microsoft Edge based on Edge HTML improperly handles \n objects in memory. An attacker who successfully exploited \n the vulnerability could obtain information to further \n compromise the user\u00e2\u0080\u0099s system. To exploit the vulnerability, \n in a web-based attack scenario, an attacker could host a \n website in an attempt to exploit the vulnerability. In \n addition, compromised websites and websites that accept \n or host user-provided content could contain specially \n crafted content that could exploit the vulnerability. \n (CVE-2019-1356)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An elevation of privilege vulnerability exists in\n Microsoft Windows Setup when it does not properly handle\n privileges. An attacker who successfully exploited this\n vulnerability could run processes in an elevated\n context. An attacker could then install programs; view,\n change or delete data. (CVE-2019-1316)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A remote code execution vulnerability exists in the way \n that the Chakra scripting engine handles objects in \n memory in Microsoft Edge (HTML-based). The vulnerability\n could corrupt memory in such a way that an attacker could \n execute arbitrary code in the context of the current user. \n An attacker who successfully exploited the vulnerability \n could gain the same user rights as the current user. If \n the current user is logged on with administrative user \n rights, an attacker who successfully exploited the \n vulnerability could take control of an affected system. \n An attacker could then install programs; view, change, \n or delete data; or create new accounts with full user \n rights. (CVE-2019-1366)\");\n # https://support.microsoft.com/en-us/help/4519998/windows-10-update-kb4519998\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5df9140f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Cumulative Update KB4519998.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:edge\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4519998');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"10\",\n sp:0,\n os_build:\"14393\",\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4519998])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:17:21", "description": "The remote Windows host is missing security update 4519985 or cumulative update 4520007. It is, therefore, affected by multiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4519985: Windows Server 2012 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS19_OCT_4520007.NASL", "href": "https://www.tenable.com/plugins/nessus/129723", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129723);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1346\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520007\");\n script_xref(name:\"MSKB\", value:\"4519985\");\n script_xref(name:\"MSFT\", value:\"MS19-4520007\");\n script_xref(name:\"MSFT\", value:\"MS19-4519985\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4519985: Windows Server 2012 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4519985\nor cumulative update 4520007. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346)\");\n # https://support.microsoft.com/en-us/help/4520007/windows-server-2012-update-kb4520007\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7d72b58b\");\n # https://support.microsoft.com/en-us/help/4519985/windows-server-2012-update-kb4519985\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e7951661\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4519985 or Cumulative Update KB4520007.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520007', '4519985');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\n# Windows 8 EOL\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.2\",\n sp:0,\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520007, 4519985])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:17:53", "description": "The remote Windows host is missing security update 4520003 or cumulative update 4519976. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLMv2 protection if a client is also sending LMv2 responses. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features.\n (CVE-2019-1338)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1346)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability. (CVE-2019-1363)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1362, CVE-2019-1364)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information that could be useful for further exploitation. (CVE-2019-1361)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520003: Windows 7 and Windows Server 2008 R2 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1315", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1361", "CVE-2019-1362", "CVE-2019-1363", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS19_OCT_4519976.NASL", "href": "https://www.tenable.com/plugins/nessus/129718", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129718);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1315\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1338\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1344\",\n \"CVE-2019-1346\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1361\",\n \"CVE-2019-1362\",\n \"CVE-2019-1363\",\n \"CVE-2019-1364\",\n \"CVE-2019-1365\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4519976\");\n script_xref(name:\"MSKB\", value:\"4520003\");\n script_xref(name:\"MSFT\", value:\"MS19-4519976\");\n script_xref(name:\"MSFT\", value:\"MS19-4520003\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520003: Windows 7 and Windows Server 2008 R2 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520003\nor cumulative update 4519976. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass vulnerability exists in\n Microsoft Windows when a man-in-the-middle attacker is\n able to successfully bypass the NTLMv2 protection if a\n client is also sending LMv2 responses. An attacker who\n successfully exploited this vulnerability could gain the\n ability to downgrade NTLM security features.\n (CVE-2019-1338)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1346)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Graphics Device Interface (GDI)\n handles objects in memory, allowing an attacker to\n retrieve information from a targeted system. By itself,\n the information disclosure does not allow arbitrary code\n execution; however, it could allow arbitrary code to be\n run if the attacker uses it in combination with another\n vulnerability. (CVE-2019-1363)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Windows kernel-mode driver fails to\n properly handle objects in memory. An attacker who\n successfully exploited this vulnerability could run\n arbitrary code in kernel mode. An attacker could then\n install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1362, CVE-2019-1364)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - An information disclosure vulnerability exists in the\n way that Microsoft Graphics Components handle objects in\n memory. An attacker who successfully exploited the\n vulnerability could obtain information that could be\n useful for further exploitation. (CVE-2019-1361)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\");\n # https://support.microsoft.com/en-us/help/4519976/windows-7-update-kb4519976\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?60746595\");\n # https://support.microsoft.com/en-us/help/4520003/windows-7-update-kb4520003\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5576f622\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4520003 or Cumulative Update KB4519976.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4519976', '4520003');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win7:'1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.1\",\n sp:1,\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4519976, 4520003])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:17:55", "description": "The remote Windows host is missing security update 4519990 or cumulative update 4520005. It is, therefore, affected by multiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. (CVE-2019-1311)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1334)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specific local calls within Windows 7 for 32-bit systems. When this vulnerability is exploited within other versions of Windows it can cause a denial of service, but not an elevation of privilege. (CVE-2019-1325)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1343, CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4519990: Windows 8.1 and Windows Server 2012 R2 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1357", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS19_OCT_4520005.NASL", "href": "https://www.tenable.com/plugins/nessus/129722", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129722);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1060\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1311\",\n \"CVE-2019-1315\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1325\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1334\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1343\",\n \"CVE-2019-1344\",\n \"CVE-2019-1346\",\n \"CVE-2019-1347\",\n \"CVE-2019-1357\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1365\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4519990\");\n script_xref(name:\"MSKB\", value:\"4520005\");\n script_xref(name:\"MSFT\", value:\"MS19-4519990\");\n script_xref(name:\"MSFT\", value:\"MS19-4520005\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4519990: Windows 8.1 and Windows Server 2012 R2 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4519990\nor cumulative update 4520005. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - A remote code execution vulnerability exists when the\n Windows Imaging API improperly handles objects in\n memory. The vulnerability could corrupt memory in a way\n that enables an attacker to execute arbitrary code in\n the context of the current user. (CVE-2019-1311)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An information disclosure vulnerability exists when the\n Windows kernel improperly handles objects in memory. An\n attacker who successfully exploited this vulnerability\n could obtain information to further compromise the users\n system. (CVE-2019-1334)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - An elevation of privilege vulnerability exists in the\n Windows redirected drive buffering system (rdbss.sys)\n when the operating system improperly handles specific\n local calls within Windows 7 for 32-bit systems. When\n this vulnerability is exploited within other versions of\n Windows it can cause a denial of service, but not an\n elevation of privilege. (CVE-2019-1325)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1343,\n CVE-2019-1346, CVE-2019-1347)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - A remote code execution vulnerability exists when the\n Microsoft XML Core Services MSXML parser processes user\n input. An attacker who successfully exploited the\n vulnerability could run malicious code remotely to take\n control of the users system. (CVE-2019-1060)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4519990/windows-8-1-kb4519990\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4520005/windows-8-1-kb4520005\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4519990 or Cumulative Update KB4520005.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520005', '4519990');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\n# Windows 8 EOL\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.3\",\n sp:0,\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520005, 4519990])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-17T15:17:54", "description": "The remote Windows host is missing security update 4520009 or cumulative update 4520002. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)\n\n - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this vulnerability could execute arbitrary code on the computer of the connecting client. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLMv2 protection if a client is also sending LMv2 responses. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features.\n (CVE-2019-1338)\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. (CVE-2019-1166)\n\n - A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. (CVE-2019-1346)\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n (CVE-2019-1362, CVE-2019-1364)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash. An attacker who successfully exploited this vulnerability could delete a targeted file leading to an elevated status. (CVE-2019-1342)\n\n - An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2019-1344)\n\n - An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it. An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests. (CVE-2019-1365)\n\n - An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function. An attacker who successfully exploited this vulnerability could delete a targeted registry key leading to an elevated status.\n (CVE-2019-1341)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "KB4520009: Windows Server 2008 October 2019 Security Update", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1315", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1362", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1371"], "modified": "2023-03-08T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS19_OCT_4520002.NASL", "href": "https://www.tenable.com/plugins/nessus/129720", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129720);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/08\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1166\",\n \"CVE-2019-1238\",\n \"CVE-2019-1315\",\n \"CVE-2019-1318\",\n \"CVE-2019-1319\",\n \"CVE-2019-1326\",\n \"CVE-2019-1333\",\n \"CVE-2019-1338\",\n \"CVE-2019-1339\",\n \"CVE-2019-1341\",\n \"CVE-2019-1342\",\n \"CVE-2019-1344\",\n \"CVE-2019-1346\",\n \"CVE-2019-1358\",\n \"CVE-2019-1359\",\n \"CVE-2019-1362\",\n \"CVE-2019-1364\",\n \"CVE-2019-1365\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4520002\");\n script_xref(name:\"MSKB\", value:\"4520009\");\n script_xref(name:\"MSFT\", value:\"MS19-4520002\");\n script_xref(name:\"MSFT\", value:\"MS19-4520009\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/04/05\");\n\n script_name(english:\"KB4520009: Windows Server 2008 October 2019 Security Update\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Windows host is missing security update 4520009\nor cumulative update 4520002. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability exists when the\n Windows Jet Database Engine improperly handles objects\n in memory. An attacker who successfully exploited this\n vulnerability could execute arbitrary code on a victim\n system. An attacker could exploit this vulnerability by\n enticing a victim to open a specially crafted file. The\n update addresses the vulnerability by correcting the way\n the Windows Jet Database Engine handles objects in\n memory. (CVE-2019-1358, CVE-2019-1359)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\n\n - A remote code execution vulnerability exists in the\n Windows Remote Desktop Client when a user connects to a\n malicious server. An attacker who successfully exploited\n this vulnerability could execute arbitrary code on the\n computer of the connecting client. An attacker could\n then install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1333)\n\n - A security feature bypass vulnerability exists in\n Microsoft Windows when a man-in-the-middle attacker is\n able to successfully bypass the NTLMv2 protection if a\n client is also sending LMv2 responses. An attacker who\n successfully exploited this vulnerability could gain the\n ability to downgrade NTLM security features.\n (CVE-2019-1338)\n\n - A tampering vulnerability exists in Microsoft Windows\n when a man-in-the-middle attacker is able to\n successfully bypass the NTLM MIC (Message Integrity\n Check) protection. An attacker who successfully\n exploited this vulnerability could gain the ability to\n downgrade NTLM security features. (CVE-2019-1166)\n\n - A denial of service vulnerability exists when Windows\n improperly handles objects in memory. An attacker who\n successfully exploited the vulnerability could cause a\n target system to stop responding. (CVE-2019-1346)\n\n - A spoofing vulnerability exists when Transport Layer\n Security (TLS) accesses non- Extended Master Secret\n (EMS) sessions. An attacker who successfully exploited\n this vulnerability may gain access to unauthorized\n information. (CVE-2019-1318)\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A denial of service vulnerability exists in Remote\n Desktop Protocol (RDP) when an attacker connects to the\n target system using RDP and sends specially crafted\n requests. An attacker who successfully exploited this\n vulnerability could cause the RDP service on the target\n system to stop responding. (CVE-2019-1326)\n\n - An elevation of privilege vulnerability exists in\n Windows when the Windows kernel-mode driver fails to\n properly handle objects in memory. An attacker who\n successfully exploited this vulnerability could run\n arbitrary code in kernel mode. An attacker could then\n install programs; view, change, or delete data; or\n create new accounts with full user rights.\n (CVE-2019-1362, CVE-2019-1364)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles a\n process crash. An attacker who successfully exploited\n this vulnerability could delete a targeted file leading\n to an elevated status. (CVE-2019-1342)\n\n - An information disclosure vulnerability exists in the\n way that the Windows Code Integrity Module handles\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2019-1344)\n\n - An elevation of privilege vulnerability exists when\n Windows Error Reporting manager improperly handles hard\n links. An attacker who successfully exploited this\n vulnerability could overwrite a targeted file leading to\n an elevated status. (CVE-2019-1315, CVE-2019-1339)\n\n - An elevation of privilege vulnerability exists when\n Microsoft IIS Server fails to check the length of a\n buffer prior to copying memory to it. An attacker who\n successfully exploited this vulnerability can allow an\n unprivileged function ran by the user to execute code in\n the context of NT AUTHORITY\\system escaping the Sandbox.\n The security update addresses the vulnerability by\n correcting how Microsoft IIS Server sanitizes web\n requests. (CVE-2019-1365)\n\n - An elevation of privilege vulnerability exists in\n Windows Error Reporting (WER) when WER handles and\n executes files. The vulnerability could allow elevation\n of privilege if an attacker can successfully exploit it.\n An attacker who successfully exploited the vulnerability\n could gain greater access to sensitive information and\n system functionality. (CVE-2019-1319)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - An elevation of privilege vulnerability exists when\n umpo.dll of the Power Service, improperly handles a\n Registry Restore Key function. An attacker who\n successfully exploited this vulnerability could delete a\n targeted registry key leading to an elevated status.\n (CVE-2019-1341)\");\n # https://support.microsoft.com/en-us/help/4520002/windows-server-2008-update-kb4520002\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?72b9f640\");\n # https://support.microsoft.com/en-us/help/4520009/windows-server-2008-update-kb4520009\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e19f82ff\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply Security Only update KB4520009 or Cumulative Update KB4520002.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1359\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-1365\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:\"CANVAS\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = \"MS19-10\";\nkbs = make_list('4520009', '4520002');\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Vista\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n smb_check_rollup(os:\"6.0\",\n sp:2,\n rollup_date:\"10_2019\",\n bulletin:bulletin,\n rollup_kb_list:[4520009, 4520002])\n)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:29:16", "description": "The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2019-1070) \n - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross- site scripting attacks on affected systems and run script in the security context of the current user.\n These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2019-1328)\n\n - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2019-1329)\n\n - An elevation of privilege vulnerability exists in Microsoft SharePoint. An attacker who successfully exploited this vulnerability could attempt to impersonate another user of the SharePoint server.\n (CVE-2019-1330)\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1331)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft SharePoint Server (Oct 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1070", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331"], "modified": "2021-01-28T00:00:00", "cpe": ["cpe:/a:microsoft:sharepoint_foundation", "cpe:/a:microsoft:sharepoint_server", "cpe:/a:microsoft:office"], "id": "SMB_NT_MS19_OCT_OFFICE_SHAREPOINT.NASL", "href": "https://www.tenable.com/plugins/nessus/129731", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129731);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2019-1070\",\n \"CVE-2019-1328\",\n \"CVE-2019-1329\",\n \"CVE-2019-1330\",\n \"CVE-2019-1331\"\n );\n script_xref(name:\"MSKB\", value:\"4462176\");\n script_xref(name:\"MSKB\", value:\"4462215\");\n script_xref(name:\"MSKB\", value:\"4475608\");\n script_xref(name:\"MSKB\", value:\"4484111\");\n script_xref(name:\"MSKB\", value:\"4484110\");\n script_xref(name:\"MSKB\", value:\"4484122\");\n script_xref(name:\"MSKB\", value:\"4484131\");\n script_xref(name:\"MSFT\", value:\"MS19-4462176\");\n script_xref(name:\"MSFT\", value:\"MS19-4462215\");\n script_xref(name:\"MSFT\", value:\"MS19-4475608\");\n script_xref(name:\"MSFT\", value:\"MS19-4484110\");\n script_xref(name:\"MSFT\", value:\"MS19-4484111\");\n script_xref(name:\"MSFT\", value:\"MS19-4484122\");\n script_xref(name:\"MSFT\", value:\"MS19-4484131\");\n script_xref(name:\"IAVA\", value:\"2019-A-0359-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server (Oct 2019)\");\n script_summary(english:\"Checks for Microsoft security updates.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server installation on the remote\nhost is missing security updates. It is, therefore, affected\nby multiple vulnerabilities :\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2019-1070)\n \n - A spoofing vulnerability exists when Microsoft\n SharePoint Server does not properly sanitize a specially\n crafted web request to an affected SharePoint server. An\n authenticated attacker could exploit the vulnerability\n by sending a specially crafted request to an affected\n SharePoint server. The attacker who successfully\n exploited the vulnerability could then perform cross-\n site scripting attacks on affected systems and run\n script in the security context of the current user.\n These attacks could allow the attacker to read content\n that the attacker is not authorized to read, use the\n victim's identity to take actions on the SharePoint site\n on behalf of the user, such as change permissions and\n delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2019-1328)\n\n - An elevation of privilege vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. These attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2019-1329)\n\n - An elevation of privilege vulnerability exists in\n Microsoft SharePoint. An attacker who successfully\n exploited this vulnerability could attempt to\n impersonate another user of the SharePoint server.\n (CVE-2019-1330)\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2019-1331)\");\n # https://support.microsoft.com/en-us/help/4475608/security-update-for-sharepoint-enterprise-server-2013-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?73c5cc63\");\n # https://support.microsoft.com/en-us/help/4462176/security-update-for-sharepoint-server-2010-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?707ff09a\");\n # https://support.microsoft.com/en-us/help/4484122/security-update-for-sharepoint-foundation-2013-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b9af99b6\");\n # https://support.microsoft.com/en-us/help/4462215/security-update-for-sharepoint-enterprise-server-2013-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?dd9d4866\");\n # https://support.microsoft.com/en-us/help/4484111/security-update-for-sharepoint-enterprise-server-2016\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6fc6eac4\");\n # https://support.microsoft.com/en-us/help/4484110/security-update-for-sharepoint-server-2019-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?b9b7b956\");\n # https://support.microsoft.com/en-us/help/4484131/security-update-for-sharepoint-foundation-2010-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?cade65c4\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4462176\n -KB4462215\n -KB4475608\n -KB4484110\n -KB4484111\n -KB4484122\n -KB4484131\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:office\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS19-10';\n\nkbs = make_list(\n'4484131', # 2010 Foundation\n'4462176', # 2010\n'4484122', # 2013 Foundation\n'4475608', # 2013 Foundation\n'4462215', # 2013 Server\n'4484111', # 2016 Server\n'4484110' # 2019 Server\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\nvuln = FALSE;\nport = kb_smb_transport();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\n# direct reference lookup of product...\nkb_checks =\n{\n '2010':\n # direct reference lookup of SP...\n { '2':\n {'Server':\n [{\n 'kb': '4462176',\n 'path': install['path'],\n 'append':'bin',\n 'file':'xlsrv.dll',\n 'version':'14.0.7239.5000',\n 'min_version':'14.0.0.0',\n 'product_name':'Microsoft SharePoint Enterprise Server 2010 SP2'\n }],\n # direct reference lookup of edition...\n 'Foundation':\n [{\n 'kb': '4484131',\n 'path': hotfix_get_commonfilesdir(),\n 'append':'microsoft shared\\\\web server extensions\\\\14\\\\bin', \n 'file':'onetutil.dll', \n 'version':'14.0.7237.5000', \n 'version':'14.0.7239.5000',\n 'min_version':'14.0.0.0',\n 'product_name':'Microsoft SharePoint Foundation Server 2010 SP2'\n }]\n }\n },\n '2013':\n # direct reference lookup of SP...\n { '1':\n # direct reference lookup of edition...\n {'Server':\n [{\n 'kb': '4462215',\n 'path': install['path'],\n 'append':'bin',\n 'file':'xlsrv.dll',\n 'version':'15.0.5179.1000',\n 'min_version':'15.0.0.0',\n 'product_name':'Microsoft SharePoint Enterprise Server 2013 SP1'\n },\n {\n 'kb': '4475608',\n 'path': install['path'],\n 'append':'transformapps',\n 'file':'docxpageconverter.exe',\n 'version':'15.0.5179.1000',\n 'min_version':'15.0.0.0',\n 'product_name':'Microsoft SharePoint Enterprise Server 2013 SP1'\n }],\n 'Foundation':\n [{\n 'kb': '4484122',\n 'path': hotfix_get_commonfilesdir(),\n 'append':'microsoft shared\\\\web server extensions\\\\15\\\\bin',\n 'file':'csisrv.dll',\n 'version':'15.0.5111.1000',\n 'min_version':'15.0.0.0',\n 'product_name':'Microsoft SharePoint Foundation Server 2013 SP1'\n }]\n }\n },\n '2016':\n # direct reference lookup of SP...\n { '0':\n # direct reference lookup of edition...\n {'Server':\n [{\n 'kb': '4484111',\n 'path': install['path'],\n 'append':'webservices\\\\conversionservices',\n 'file':'msoserver.dll',\n 'version':'16.0.4912.1000',\n 'min_version':'16.0.0.0',\n 'product_name':'Microsoft SharePoint Enterprise Server 2016'\n }]\n }\n },\n '2019':\n # direct reference lookup of SP...\n { '0':\n # direct reference lookup of edition...\n {'Server':\n [{\n 'kb': '4484110',\n 'path': install['path'],\n 'append':'bin',\n 'file':'microsoft.sharepoint.publishing.dll',\n 'version':'16.0.10351.20000',\n 'min_version':'16.0.10000.0',\n 'product_name':'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, \"Microsoft SharePoint Server\");\n\nvuln = FALSE;\nxss = FALSE;\n# grab the path otherwise\nforeach check (param_list)\n{\n path = hotfix_append_path(path:check['path'], value:check['append']);\n are_we_vuln = hotfix_check_fversion(file:check['file'], version:check['version'], path:path, kb:check['kb'], product:check['product_name']);\n if (are_we_vuln == HCF_OLDER)\n {\n if (check['kb'] != '4484122' ) xss = TRUE;\n vuln = TRUE;\n }\n}\n\nif (vuln == TRUE)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/'+port+'/XSS', value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-23T15:01:49", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft SharePoint software when the software fails to properly handle objects in memory.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists in Microsoft SharePoint.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-04-29T00:00:00", "type": "nessus", "title": "Microsoft SharePoint Server 2013 build < 15.0.5179.1000 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1070", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331"], "modified": "2023-03-14T00:00:00", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "id": "WEB_APPLICATION_SCANNING_112328", "href": "https://www.tenable.com/plugins/was/112328", "sourceData": "No source data", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-23T15:01:47", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft SharePoint software when the software fails to properly handle objects in memory.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists in Microsoft SharePoint.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-04-29T00:00:00", "type": "nessus", "title": "Microsoft SharePoint Server 2016 build < 16.0.4912.1000 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1070", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331"], "modified": "2023-03-14T00:00:00", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "id": "WEB_APPLICATION_SCANNING_112329", "href": "https://www.tenable.com/plugins/was/112329", "sourceData": "No source data", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-03-23T15:01:48", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft SharePoint software when the software fails to properly handle objects in memory.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - An elevation of privilege vulnerability exists in Microsoft SharePoint.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-04-29T00:00:00", "type": "nessus", "title": "Microsoft SharePoint Server 2019 build < 16.0.10351.20000 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1070", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331"], "modified": "2023-03-14T00:00:00", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "id": "WEB_APPLICATION_SCANNING_112330", "href": "https://www.tenable.com/plugins/was/112330", "sourceData": "No source data", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:30:07", "description": "The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1238)\n\n - A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies. An attacker who successfully exploited this vulnerability could trick a browser into overwriting a secure cookie with an insecure cookie. The insecure cookie could serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-1357)\n\n - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user request by crafting HTTP queries. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2019-1371)", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "Security Updates for Internet Explorer (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1238", "CVE-2019-1357", "CVE-2019-1371"], "modified": "2019-11-15T00:00:00", "cpe": ["cpe:/o:microsoft:windows"], "id": "SMB_NT_MS19_OCT_INTERNET_EXPLORER.NASL", "href": "https://www.tenable.com/plugins/nessus/129728", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129728);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/11/15\");\n\n script_cve_id(\n \"CVE-2019-0608\",\n \"CVE-2019-1238\",\n \"CVE-2019-1357\",\n \"CVE-2019-1371\"\n );\n script_xref(name:\"MSKB\", value:\"4519976\");\n script_xref(name:\"MSKB\", value:\"4520007\");\n script_xref(name:\"MSKB\", value:\"4519974\");\n script_xref(name:\"MSKB\", value:\"4520005\");\n script_xref(name:\"MSKB\", value:\"4520002\");\n script_xref(name:\"MSFT\", value:\"MS19-4519976\");\n script_xref(name:\"MSFT\", value:\"MS19-4520007\");\n script_xref(name:\"MSFT\", value:\"MS19-4519974\");\n script_xref(name:\"MSFT\", value:\"MS19-4520005\");\n script_xref(name:\"MSFT\", value:\"MS19-4520002\");\n\n script_name(english:\"Security Updates for Internet Explorer (October 2019)\");\n script_summary(english:\"Checks for Microsoft security updates.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Internet Explorer installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Internet Explorer installation on the remote host is\nmissing security updates. It is, therefore, affected by\nmultiple vulnerabilities :\n\n - A remote code execution vulnerability exists in the way\n that the VBScript engine handles objects in memory. The\n vulnerability could corrupt memory in such a way that an\n attacker could execute arbitrary code in the context of\n the current user. An attacker who successfully exploited\n the vulnerability could gain the same user rights as the\n current user. (CVE-2019-1238)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n improperly handle browser cookies. An attacker who\n successfully exploited this vulnerability could trick a\n browser into overwriting a secure cookie with an\n insecure cookie. The insecure cookie could serve as a\n pivot to chain an attack with other vulnerabilities in\n web services. (CVE-2019-1357)\n\n - A spoofing vulnerability exists when Microsoft Browsers\n does not properly parse HTTP content. An attacker who\n successfully exploited this vulnerability could\n impersonate a user request by crafting HTTP queries. The\n specially crafted website could either spoof content or\n serve as a pivot to chain an attack with other\n vulnerabilities in web services. (CVE-2019-0608)\n\n - A remote code execution vulnerability exists when\n Internet Explorer improperly accesses objects in memory.\n The vulnerability could corrupt memory in such a way\n that an attacker could execute arbitrary code in the\n context of the current user. An attacker who\n successfully exploited the vulnerability could gain the\n same user rights as the current user. (CVE-2019-1371)\");\n # https://support.microsoft.com/en-us/help/4519976/windows-7-update-kb4519976\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?60746595\");\n # https://support.microsoft.com/en-us/help/4520007/windows-server-2012-update-kb4520007\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?7d72b58b\");\n # https://support.microsoft.com/en-us/help/4519974/cumulative-security-update-for-internet-explorer\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8e535add\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4520005/windows-8-1-kb4520005\");\n # https://support.microsoft.com/en-us/help/4520002/windows-server-2008-update-kb4520002\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?72b9f640\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4519974\n -KB4519976\n -KB4520002\n -KB4520005\n -KB4520007\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1371\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"smb_check_rollup.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\n\n\ninclude(\"audit.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS19-10';\nkbs = make_list(\n '4519974',\n '4519976',\n '4520002',\n '4520005',\n '4520007'\n);\n\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nos = get_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(vista:'2', win7:'1', win8:'0', win81:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nproductname = get_kb_item_or_exit(\"SMB/ProductName\", exit_code:1);\nif (\"Windows 8\" >< productname && \"8.1\" >!< productname)\n audit(AUDIT_OS_SP_NOT_VULN);\nif (\"Vista\" >< productname) audit(AUDIT_OS_SP_NOT_VULN);\n\nif (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);\n\nshare = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n # Windows 8.1 / Windows Server 2012 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.3\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.19504\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4519974\") ||\n\n # Windows Server 2012\n # Internet Explorer 10\n hotfix_is_vulnerable(os:\"6.2\", sp:0, file:\"mshtml.dll\", version:\"10.0.9200.22887\", min_version:\"10.0.9200.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4519974\") ||\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.2\", sp:0, file:\"mshtml.dll\", version:\"11.0.9600.19501\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4519974\") ||\n \n # Windows 7 / Server 2008 R2\n # Internet Explorer 11\n hotfix_is_vulnerable(os:\"6.1\", sp:1, file:\"mshtml.dll\", version:\"11.0.9600.19504\", min_version:\"11.0.9600.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4519974\") ||\n\n # Windows Server 2008\n # Internet Explorer 9\n hotfix_is_vulnerable(os:\"6.0\", sp:2, file:\"mshtml.dll\", version:\"9.0.8112.21379\", min_version:\"9.0.8112.16000\", dir:\"\\system32\", bulletin:bulletin, kb:\"4519974\")\n)\n{\n report = '\\nNote: The fix for this issue is available in either of the following updates:\\n';\n report += ' - KB4519974 : Cumulative Security Update for Internet Explorer\\n';\n if(os == \"6.3\")\n {\n report += ' - KB4520005 : Windows 8.1 / Server 2012 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS19-10', kb:'4520005', report);\n }\n else if(os == \"6.2\")\n {\n report += ' - KB4520007 : Windows Server 2012 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS19-10', kb:'4520007', report);\n }\n else if(os == \"6.1\")\n {\n report += ' - KB4519976 : Windows 7 / Server 2008 R2 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS19-10', kb:'4519976', report);\n }\n else if(os == \"6.0\")\n {\n report += ' - KB4520002 : Windows Server 2008 Monthly Rollup\\n';\n hotfix_add_report(bulletin:'MS19-10', kb:'4520002', report);\n }\n set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, hotfix_get_audit_report());\n}\n", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:28:46", "description": "The Microsoft Office Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1327, CVE-2019-1331)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Office Products (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1327", "CVE-2019-1331"], "modified": "2022-06-10T00:00:00", "cpe": ["cpe:/a:microsoft:office"], "id": "SMB_NT_MS19_OCT_OFFICE.NASL", "href": "https://www.tenable.com/plugins/nessus/129730", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129730);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/10\");\n\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_xref(name:\"MSKB\", value:\"4475558\");\n script_xref(name:\"MSKB\", value:\"4475554\");\n script_xref(name:\"MSKB\", value:\"4475569\");\n script_xref(name:\"MSFT\", value:\"MS19-4475558\");\n script_xref(name:\"MSFT\", value:\"MS19-4475554\");\n script_xref(name:\"MSFT\", value:\"MS19-4475569\");\n\n script_name(english:\"Security Updates for Microsoft Office Products (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Office Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Office Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2019-1327, CVE-2019-1331)\");\n # https://support.microsoft.com/en-us/help/4475558/security-update-for-office-2013-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?2b215d1b\");\n # https://support.microsoft.com/en-us/help/4475554/description-of-the-security-update-for-office-2016-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?477338a6\");\n # https://support.microsoft.com/en-us/help/4475569/security-update-for-office-2010-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1cf3228a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4475558\n -KB4475554\n -KB4475569\nFor Office 365, Office 2016 C2R, or Office 2019, ensure\nautomatic updates are enabled or open any office app and\nmanually perform an update.\");\n\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:office\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"office_installed.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS19-10';\nkbs = make_list(\n '4475558',\n '4475554',\n '4475569'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\nvuln = FALSE;\nport = kb_smb_transport();\n\noffice_vers = hotfix_check_office_version();\n\n# Office 2010 SP2\nif (office_vers['14.0'])\n{\n office_sp = get_kb_item('SMB/Office/2010/SP');\n if (!isnull(office_sp) && office_sp == 2)\n {\n prod = 'Microsoft Office 2010 SP2';\n\n path = hotfix_get_officeprogramfilesdir(officever:'14.0');\n path = hotfix_append_path(path:path, value:'Microsoft Office\\\\Office14');\n kb = '4475569';\n file = 'graph.exe';\n version = '14.0.7239.5000';\n if (hotfix_check_fversion(file:file, version:version, path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER)\n vuln = TRUE;\n }\n}\n\n# Office 2013 SP1\nif (office_vers['15.0'])\n{\n office_sp = get_kb_item('SMB/Office/2013/SP');\n if (!isnull(office_sp) && office_sp == 1)\n {\n prod = 'Microsoft Office 2013 SP1';\n\n path = hotfix_get_officeprogramfilesdir(officever:'15.0');\n path = hotfix_append_path(path:path, value:'Microsoft Office\\\\Office15');\n kb = '4475558';\n file = 'graph.exe';\n version = '15.0.5179.1000';\n if (hotfix_check_fversion(file:file, version:version, path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER )\n vuln = TRUE;\n }\n}\n\n# Office 2016\nif (office_vers['16.0'])\n{\n office_sp = get_kb_item('SMB/Office/2016/SP');\n if (!isnull(office_sp) && office_sp == 0)\n {\n prod = 'Microsoft Office 2016';\n\n path = hotfix_get_officeprogramfilesdir(officever:'16.0');\n path = hotfix_append_path(path:path, value:'Microsoft Office\\\\root\\\\Office16');\n\n\n # MSI graph.exe\n if (hotfix_check_fversion(file:'graph.exe', version:'16.0.4912.1000', channel:'MSI', channel_product:'Office', path:path, kb:'4475554', bulletin:bulletin, product:prod) == HCF_OLDER)\n vuln = TRUE;\n }\n}\nif (vuln)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:30:44", "description": "The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1327, CVE-2019-1331)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Excel Products (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1327", "CVE-2019-1331"], "modified": "2022-06-10T00:00:00", "cpe": ["cpe:/a:microsoft:excel"], "id": "SMB_NT_MS19_OCT_EXCEL.NASL", "href": "https://www.tenable.com/plugins/nessus/129727", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129727);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/10\");\n\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_xref(name:\"MSKB\", value:\"4484123\");\n script_xref(name:\"MSKB\", value:\"4484130\");\n script_xref(name:\"MSKB\", value:\"4484112\");\n script_xref(name:\"MSFT\", value:\"MS19-4484123\");\n script_xref(name:\"MSFT\", value:\"MS19-4484130\");\n script_xref(name:\"MSFT\", value:\"MS19-4484112\");\n\n script_name(english:\"Security Updates for Microsoft Excel Products (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Excel Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2019-1327, CVE-2019-1331)\");\n # https://support.microsoft.com/en-us/help/4484123/security-update-for-excel-2013-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?db7369fe\");\n # https://support.microsoft.com/en-us/help/4484130/security-update-for-excel-2010-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5aa1a31f\");\n # https://support.microsoft.com/en-us/help/4484112/security-update-for-excel-2016-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f8d51dda\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released the following security updates to address this issue: \n -KB4484123\n -KB4484130\n -KB4484112\nFor Office 365, Office 2016 C2R, or Office 2019, ensure\nautomatic updates are enabled or open any office app and\nmanually perform an update.\");\n\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:excel\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"office_installed.nasl\", \"microsoft_office_compatibility_pack_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('install_func.inc');\n\nglobal_var vuln;\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS19-10';\nkbs = make_list(\n4484130,\n4484123,\n4484112\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\nport = kb_smb_transport();\n\nchecks = make_array(\n '14.0', make_array('sp', 2, 'version', '14.0.7239.5000', 'kb', '4484130'),\n '15.0', make_array('sp', 1, 'version', '15.0.5179.1000', 'kb', '4484123'),\n '16.0', make_nested_list(make_array('sp', 0, 'version', '16.0.4912.1000', 'channel', 'MSI', 'kb', '4484112'))\n);\n\nif (hotfix_check_office_product(product:'Excel', checks:checks, bulletin:bulletin))\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-10T19:23:05", "description": "The Microsoft Office Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1327, CVE-2019-1331)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-06-10T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Office Products C2R (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1327", "CVE-2019-1331"], "modified": "2022-06-10T00:00:00", "cpe": ["cpe:/a:microsoft:office"], "id": "SMB_NT_MS19_OCT_OFFICE_C2R.NASL", "href": "https://www.tenable.com/plugins/nessus/162108", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('compat.inc');\n\nif (description)\n{\n script_id(162108);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/10\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n\n script_name(english:\"Security Updates for Microsoft Office Products C2R (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Office Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Office Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2019-1327, CVE-2019-1331)\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fd4508ff\");\n script_set_attribute(attribute:\"solution\", value:\n\"For Office 365, Office 2016 C2R, or Office 2019, ensure automatic\nupdates are enabled or open any office app and manually perform an\nupdate.\");\n\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/06/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:office\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_dependencies(\"office_installed.nasl\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('vcf_extras_office.inc');\n\nvar bulletin = 'MS19-10';\n\nvar app_info = vcf::microsoft::office::get_app_info(app:'Microsoft Office');\n\nvar constraints = [\n \n {'product':'Microsoft Office 2016','file':'mso.dll','fixed_version':'16.0.10730.20386','channel': 'Deferred'},\n {'product':'Microsoft Office 2016','file':'mso.dll','fixed_version':'16.0.11328.20438','channel': 'Deferred','channel_version': '1902'},\n {'product':'Microsoft Office 2016','file':'mso.dll','fixed_version':'16.0.11929.20396','channel': 'First Release for Deferred'},\n {'product':'Microsoft Office 2016','file':'mso.dll','fixed_version':'16.0.12026.20320','channel': 'Current'},\n {'product':'Microsoft Office 2019','file':'mso.dll','fixed_version':'16.0.12026.20320','channel': '2019 Retail'},\n {'product':'Microsoft Office 2019','file':'mso.dll','fixed_version':'16.0.10351.20054','channel': '2019 Volume'}\n];\n\nvcf::microsoft::office::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_HOLE,\n bulletin:bulletin,\n subproduct:'Office'\n);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-10T19:23:03", "description": "The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2019-1327, CVE-2019-1331)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2022-06-10T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Excel Products C2R (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1327", "CVE-2019-1331"], "modified": "2022-06-10T00:00:00", "cpe": ["cpe:/a:microsoft:excel"], "id": "SMB_NT_MS19_OCT_EXCEL_C2R.NASL", "href": "https://www.tenable.com/plugins/nessus/162121", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('compat.inc');\n\nif (description)\n{\n script_id(162121);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/10\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n\n script_name(english:\"Security Updates for Microsoft Excel Products C2R (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Excel Products are affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Excel Products are missing security updates.\nIt is, therefore, affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in\n Microsoft Excel software when the software fails to\n properly handle objects in memory. An attacker who\n successfully exploited the vulnerability could run\n arbitrary code in the context of the current user. If\n the current user is logged on with administrative user\n rights, an attacker could take control of the affected\n system. An attacker could then install programs; view,\n change, or delete data; or create new accounts with full\n user rights. (CVE-2019-1327, CVE-2019-1331)\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fd4508ff\");\n script_set_attribute(attribute:\"solution\", value:\n\"For Office 365, Office 2016 C2R, or Office 2019, ensure automatic\nupdates are enabled or open any office app and manually perform an\nupdate.\");\n\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/06/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:excel\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_dependencies(\"office_installed.nasl\", \"microsoft_office_compatibility_pack_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('vcf_extras_office.inc');\n\nvar bulletin = 'MS19-10';\n\nvar constraints = [\n {'fixed_version':'16.0.10730.20386','channel': 'Deferred'},\n {'fixed_version':'16.0.11328.20438','channel': 'Deferred','channel_version': '1902'},\n {'fixed_version':'16.0.11929.20396','channel': 'First Release for Deferred'},\n {'fixed_version':'16.0.12026.20320','channel': 'Current'},\n {'fixed_version':'16.0.12026.20320','channel': '2019 Retail'},\n {'fixed_version':'16.0.10351.20054','channel': '2019 Volume'}\n];\n\nvcf::microsoft::office_product::check_version_and_report(\n constraints:constraints,\n severity:SECURITY_HOLE,\n bulletin:bulletin,\n subproduct:'Excel'\n);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T15:30:02", "description": "The version of Microsoft SQL Server Management Studio installed on the remote Windows host is 18.x prior to 18.3.1. It is, therefore, affected by multiple information disclosure vulnerabilities:\n\n - An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully exploited the vulnerability could gain additional database and file information. (CVE-2019-1313) (CVE-2019-1376)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-10-08T00:00:00", "type": "nessus", "title": "Microsoft SQL Server Management Studio 18.x < 18.3.1 Multiple Vulnerabilities (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1313", "CVE-2019-1376"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:microsoft:sql_server_management_studio"], "id": "SMB_NT_MS19_OCT_SSMS.NASL", "href": "https://www.tenable.com/plugins/nessus/129715", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129715);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2019-1313\", \"CVE-2019-1376\");\n script_xref(name:\"IAVA\", value:\"2019-A-0367-S\");\n\n script_name(english:\"Microsoft SQL Server Management Studio 18.x < 18.3.1 Multiple Vulnerabilities (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The version of SQL Server Management Studio installed on the remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Microsoft SQL Server Management Studio installed on the remote Windows host is 18.x prior to 18.3.1. It\nis, therefore, affected by multiple information disclosure vulnerabilities:\n\n - An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it\n improperly enforces permissions. An attacker could exploit the vulnerability if the attacker's credentials\n allow access to an affected SQL server database. An attacker who successfully exploited the vulnerability\n could gain additional database and file information. (CVE-2019-1313) (CVE-2019-1376)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n # https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-management-studio-ssms?view=sql-server-2017\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?00f3184c\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update to Microsoft SQL Server Management Studio 18.3.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1376\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/08\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sql_server_management_studio\");\n script_set_attribute(attribute:\"stig_severity\", value:\"II\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_ssms_installed.nbin\");\n script_require_keys(\"SMB/Registry/Enumerated\", \"installed_sw/Microsoft SSMS\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\ninclude(\"vcf.inc\");\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\napp_info = vcf::get_app_info(app:\"Microsoft SSMS\");\n\n# 18.0 is 2019.150.18118.0\n# 18.3.1 is 2019.150.18183.0\nconstraints = [\n { \"min_version\":\"2019.150.18118.0\", \"fixed_version\":\"2019.150.18183.0\", \"fixed_display\":\"2019.150.18183.0 (18.3.1)\"}\n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-01-11T15:29:39", "description": "The Microsoft Office Online Server installation on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-15T00:00:00", "type": "nessus", "title": "Security Updates for Microsoft Office Online Server (October 2019)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1331"], "modified": "2020-03-13T00:00:00", "cpe": ["cpe:/a:microsoft:office_online_server"], "id": "SMB_NT_MS19_OCT_OFFICE_WEB.NASL", "href": "https://www.tenable.com/plugins/nessus/129885", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129885);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value: \"2020/03/13\");\n\n script_cve_id(\"CVE-2019-1331\");\n script_xref(name:\"MSKB\", value:\"4475595\");\n script_xref(name:\"MSFT\", value:\"MS19-4475595\");\n\n script_name(english:\"Security Updates for Microsoft Office Online Server (October 2019)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft Office Online Server installation on the remote host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft Office Online Server installation on the remote host is missing a security update. It is, therefore, \naffected by a remote code execution vulnerability in Microsoft Excel software when the software fails to properly \nhandle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the \ncontext of the current user. If the current user is logged on with administrative user rights, an attacker could take \ncontrol of the affected system. An attacker could then install programs; view, change, or delete data; or create new \naccounts with full user rights.\");\n # https://support.microsoft.com/en-us/help/4475595/security-update-for-office-online-server-october-8-2019\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3089fa2a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to the latest version of Office Online Server and apply the KB4475595 patch to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1331\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/10/15\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:office_online_server\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"office_installed.nasl\", \"microsoft_owa_installed.nbin\", \"microsoft_office_compatibility_pack_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS19-10';\nkbs = make_list('4475595');\nif (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\nport = kb_smb_transport();\n\n# Get installs of Office Web Apps\nowa_installs = get_installs(app_name:'Microsoft Office Web Apps');\n\nif (!empty_or_null(owa_installs))\n{\n foreach owa_install (owa_installs[1])\n {\n if (owa_install['Product'] == '2016')\n {\n oos_path = owa_install['path'];\n oos_sp = owa_install['SP'];\n }\n }\n}\nvuln = FALSE;\n\n####################################################################\n# Office Online Server\n####################################################################\nif (oos_path && (!isnull(oos_sp) && oos_sp == '0'))\n{\n path = hotfix_append_path(path:oos_path, value:\"ExcelServicesEcs\\bin\");\n if (hotfix_check_fversion(file:'xlsrv.dll', version:'16.0.10351.20000', min_version:'16.0.0.0', path:path, kb:'4475595', product:'Office Online Server') == HCF_OLDER)\n vuln = TRUE;\n}\n\nif (vuln)\n{\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2023-02-08T15:57:02", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, spoof user interface, bypass security restrictions, cause denial of service, execute arbitrary code.\n\n### *Exploitation*:\nMalware exists for this vulnerability. Usually such malware is classified as Exploit. [More details](<https://threats.kaspersky.com/en/class/Exploit/>).\n\n### *Affected products*:\nWindows 10 for 32-bit Systems \nWindows 8.1 for 32-bit systems \nWindows 7 for 32-bit Systems Service Pack 1 \nWindows Server, version 1903 (Server Core installation) \nWindows 10 Version 1903 for ARM64-based Systems \nWindows 8.1 for x64-based systems \nWindows 10 Version 1709 for ARM64-based Systems \nWindows Server 2012 (Server Core installation) \nWindows 10 Version 1903 for 32-bit Systems \nWindows Server 2012 R2 \nWindows Server 2008 R2 for Itanium-Based Systems Service Pack 1 \nWindows Server 2008 for 32-bit Systems Service Pack 2 \nWindows 10 Version 1809 for ARM64-based Systems \nWindows 10 Version 1803 for ARM64-based Systems \nWindows 10 Version 1703 for 32-bit Systems \nWindows 10 Version 1809 for 32-bit Systems \nWindows 10 Version 1903 for x64-based Systems \nWindows Server 2012 R2 (Server Core installation) \nWindows 10 Version 1709 for 32-bit Systems \nWindows 10 Version 1803 for 32-bit Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) \nWindows Server 2012 \nWindows 10 Version 1803 for x64-based Systems \nWindows Server 2008 for Itanium-Based Systems Service Pack 2 \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) \nWindows Server 2008 for x64-based Systems Service Pack 2 \nWindows 10 Version 1703 for x64-based Systems \nWindows 10 Version 1607 for x64-based Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 \nWindows RT 8.1 \nWindows 10 for x64-based Systems \nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) \nWindows 10 Version 1809 for x64-based Systems \nWindows 10 Version 1607 for 32-bit Systems \nWindows Server 2016 \nWindows Server 2019 \nWindows 7 for x64-based Systems Service Pack 1 \nWindows Server, version 1803 (Server Core Installation) \nWindows Server 2016 (Server Core installation) \nWindows 10 Version 1709 for x64-based Systems \nWindows Server 2019 (Server Core installation) \nWindows Update Assistant\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1337](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1337>) \n[CVE-2019-1334](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1334>) \n[CVE-2019-1322](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1322>) \n[CVE-2019-1319](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1319>) \n[CVE-2019-1318](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1318>) \n[CVE-2019-1341](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1341>) \n[CVE-2019-1368](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1368>) \n[CVE-2019-1378](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1378>) \n[CVE-2019-1315](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1315>) \n[CVE-2019-1345](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1345>) \n[CVE-2019-1230](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1230>) \n[CVE-2019-1340](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1340>) \n[CVE-2019-1316](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1316>) \n[CVE-2019-1365](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1365>) \n[CVE-2019-1166](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1166>) \n[CVE-2019-1344](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1344>) \n[CVE-2019-1343](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1343>) \n[CVE-2019-1339](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1339>) \n[CVE-2019-1317](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1317>) \n[CVE-2019-1342](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1342>) \n[CVE-2019-1346](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1346>) \n[CVE-2019-1320](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1320>) \n[CVE-2019-1323](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1323>) \n[CVE-2019-1333](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1333>) \n[CVE-2019-1347](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1347>) \n[CVE-2019-1321](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1321>) \n[CVE-2019-1358](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1358>) \n[CVE-2019-1325](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1325>) \n[CVE-2019-1326](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1326>) \n[CVE-2019-1336](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1336>) \n[CVE-2019-1359](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1359>) \n[CVE-2019-1060](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1060>) \n[CVE-2019-1311](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1311>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Windows](<https://threats.kaspersky.com/en/product/Microsoft-Windows/>)\n\n### *CVE-IDS*:\n[CVE-2019-1318](<https://vulners.com/cve/CVE-2019-1318>)4.3Warning \n[CVE-2019-1339](<https://vulners.com/cve/CVE-2019-1339>)7.2High \n[CVE-2019-1368](<https://vulners.com/cve/CVE-2019-1368>)2.1Warning \n[CVE-2019-1311](<https://vulners.com/cve/CVE-2019-1311>)9.3Critical \n[CVE-2019-1340](<https://vulners.com/cve/CVE-2019-1340>)7.2High \n[CVE-2019-1326](<https://vulners.com/cve/CVE-2019-1326>)7.8Critical \n[CVE-2019-1346](<https://vulners.com/cve/CVE-2019-1346>)7.1High \n[CVE-2019-1344](<https://vulners.com/cve/CVE-2019-1344>)2.1Warning \n[CVE-2019-1337](<https://vulners.com/cve/CVE-2019-1337>)2.1Warning \n[CVE-2019-1320](<https://vulners.com/cve/CVE-2019-1320>)4.6Warning \n[CVE-2019-1230](<https://vulners.com/cve/CVE-2019-1230>)4.0Warning \n[CVE-2019-1336](<https://vulners.com/cve/CVE-2019-1336>)7.2High \n[CVE-2019-1322](<https://vulners.com/cve/CVE-2019-1322>)4.6Warning \n[CVE-2019-1060](<https://vulners.com/cve/CVE-2019-1060>)9.3Critical \n[CVE-2019-1321](<https://vulners.com/cve/CVE-2019-1321>)7.2High \n[CVE-2019-1315](<https://vulners.com/cve/CVE-2019-1315>)7.2High \n[CVE-2019-1166](<https://vulners.com/cve/CVE-2019-1166>)4.3Warning \n[CVE-2019-1333](<https://vulners.com/cve/CVE-2019-1333>)9.3Critical \n[CVE-2019-1319](<https://vulners.com/cve/CVE-2019-1319>)7.2High \n[CVE-2019-1334](<https://vulners.com/cve/CVE-2019-1334>)2.1Warning \n[CVE-2019-1345](<https://vulners.com/cve/CVE-2019-1345>)2.1Warning \n[CVE-2019-1341](<https://vulners.com/cve/CVE-2019-1341>)7.2High \n[CVE-2019-1323](<https://vulners.com/cve/CVE-2019-1323>)7.2High \n[CVE-2019-1347](<https://vulners.com/cve/CVE-2019-1347>)7.1High \n[CVE-2019-1365](<https://vulners.com/cve/CVE-2019-1365>)9.0Critical \n[CVE-2019-1359](<https://vulners.com/cve/CVE-2019-1359>)9.3Critical \n[CVE-2019-1342](<https://vulners.com/cve/CVE-2019-1342>)7.2High \n[CVE-2019-1316](<https://vulners.com/cve/CVE-2019-1316>)7.2High \n[CVE-2019-1358](<https://vulners.com/cve/CVE-2019-1358>)9.3Critical \n[CVE-2019-1378](<https://vulners.com/cve/CVE-2019-1378>)7.2High \n[CVE-2019-1343](<https://vulners.com/cve/CVE-2019-1343>)7.1High \n[CVE-2019-1317](<https://vulners.com/cve/CVE-2019-1317>)5.6High \n[CVE-2019-1325](<https://vulners.com/cve/CVE-2019-1325>)4.9Warning\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[4520010](<http://support.microsoft.com/kb/4520010>) \n[4520008](<http://support.microsoft.com/kb/4520008>) \n[4520007](<http://support.microsoft.com/kb/4520007>) \n[4519998](<http://support.microsoft.com/kb/4519998>) \n[4520005](<http://support.microsoft.com/kb/4520005>) \n[4519990](<http://support.microsoft.com/kb/4519990>) \n[4519985](<http://support.microsoft.com/kb/4519985>) \n[4517389](<http://support.microsoft.com/kb/4517389>) \n[4519338](<http://support.microsoft.com/kb/4519338>) \n[4520011](<http://support.microsoft.com/kb/4520011>) \n[4520004](<http://support.microsoft.com/kb/4520004>) \n[4519337](<http://support.microsoft.com/kb/4519337>) \n[4519765](<http://support.microsoft.com/kb/4519765>) \n[4519335](<http://support.microsoft.com/kb/4519335>) \n[4519336](<http://support.microsoft.com/kb/4519336>) \n[4519764](<http://support.microsoft.com/kb/4519764>) \n[4023814](<http://support.microsoft.com/kb/4023814>) \n[4517388](<http://support.microsoft.com/kb/4517388>)", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11574 Multiple vulnerabilities in Microsoft Windows", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1060", "CVE-2019-1166", "CVE-2019-1230", "CVE-2019-1311", "CVE-2019-1315", "CVE-2019-1316", "CVE-2019-1317", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1320", "CVE-2019-1321", "CVE-2019-1322", "CVE-2019-1323", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1334", "CVE-2019-1336", "CVE-2019-1337", "CVE-2019-1339", "CVE-2019-1340", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1343", "CVE-2019-1344", "CVE-2019-1345", "CVE-2019-1346", "CVE-2019-1347", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1365", "CVE-2019-1368", "CVE-2019-1378"], "modified": "2022-01-18T00:00:00", "id": "KLA11574", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11574/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-08T15:51:51", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Products (Extende Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface, bypass security restrictions, cause denial of service, obtain sensitive information.\n\n### *Exploitation*:\nMalware exists for this vulnerability. Usually such malware is classified as Exploit. [More details](<https://threats.kaspersky.com/en/class/Exploit/>).\n\n### *Affected products*:\nWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) \nWindows 10 for 32-bit Systems \nWindows Server, version 1803 (Server Core Installation) \nWindows 10 Version 1903 for x64-based Systems \nInternet Explorer 9 \nWindows 10 for x64-based Systems \nWindows Server 2012 (Server Core installation) \nWindows Server 2016 (Server Core installation) \nWindows 7 for x64-based Systems Service Pack 1 \nWindows 8.1 for 32-bit systems \nWindows 8.1 for x64-based systems \nWindows Server 2008 for 32-bit Systems Service Pack 2 \nWindows Server 2012 \nInternet Explorer 11 \nWindows 10 Version 1803 for ARM64-based Systems \nWindows Server 2008 for x64-based Systems Service Pack 2 \nWindows Server 2016 \nWindows 10 Version 1709 for x64-based Systems \nWindows RT 8.1 \nWindows 10 Version 1709 for ARM64-based Systems \nWindows 10 Version 1703 for x64-based Systems \nWindows 10 Version 1809 for 32-bit Systems \nWindows Server 2008 for Itanium-Based Systems Service Pack 2 \nWindows 10 Version 1809 for ARM64-based Systems \nWindows 10 Version 1903 for 32-bit Systems \nWindows Server 2012 R2 (Server Core installation) \nWindows Server 2008 R2 for Itanium-Based Systems Service Pack 1 \nWindows Server 2019 (Server Core installation) \nMicrosoft Edge (EdgeHTML-based) \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) \nWindows 10 Version 1803 for x64-based Systems \nWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) \nWindows Server, version 1903 (Server Core installation) \nWindows 10 Version 1903 for ARM64-based Systems \nWindows 10 Version 1607 for 32-bit Systems \nWindows 10 Version 1809 for x64-based Systems \nWindows 10 Version 1607 for x64-based Systems \nWindows 10 Version 1803 for 32-bit Systems \nWindows 7 for 32-bit Systems Service Pack 1 \nWindows 10 Version 1709 for 32-bit Systems \nWindows Server 2008 R2 for x64-based Systems Service Pack 1 \nWindows 10 Version 1703 for 32-bit Systems \nInternet Explorer 10 \nWindows Server 2012 R2 \nWindows Server 2019\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1358](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1358>) \n[CVE-2019-1359](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1359>) \n[CVE-2019-1238](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1238>) \n[CVE-2019-1315](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1315>) \n[CVE-2019-1371](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1371>) \n[CVE-2019-1166](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1166>) \n[CVE-2019-1338](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1338>) \n[CVE-2019-1339](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1339>) \n[CVE-2019-1318](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1318>) \n[CVE-2019-1333](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1333>) \n[CVE-2019-1319](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1319>) \n[CVE-2019-0608](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-0608>) \n[CVE-2019-1346](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1346>) \n[CVE-2019-1344](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1344>) \n[CVE-2019-1342](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1342>) \n[CVE-2019-1341](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1341>) \n[CVE-2019-1361](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1361>) \n[CVE-2019-1363](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1363>) \n[CVE-2019-1362](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1362>) \n[CVE-2019-1365](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1365>) \n[CVE-2019-1364](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1364>) \n[CVE-2019-1325](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1325>) \n[CVE-2019-1326](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1326>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2019-1318](<https://vulners.com/cve/CVE-2019-1318>)4.3Warning \n[CVE-2019-1339](<https://vulners.com/cve/CVE-2019-1339>)7.2High \n[CVE-2019-1362](<https://vulners.com/cve/CVE-2019-1362>)7.2High \n[CVE-2019-1326](<https://vulners.com/cve/CVE-2019-1326>)7.8Critical \n[CVE-2019-1346](<https://vulners.com/cve/CVE-2019-1346>)7.1High \n[CVE-2019-1344](<https://vulners.com/cve/CVE-2019-1344>)2.1Warning \n[CVE-2019-1315](<https://vulners.com/cve/CVE-2019-1315>)7.2High \n[CVE-2019-1338](<https://vulners.com/cve/CVE-2019-1338>)4.3Warning \n[CVE-2019-1361](<https://vulners.com/cve/CVE-2019-1361>)4.3Warning \n[CVE-2019-1166](<https://vulners.com/cve/CVE-2019-1166>)4.3Warning \n[CVE-2019-1333](<https://vulners.com/cve/CVE-2019-1333>)9.3Critical \n[CVE-2019-1319](<https://vulners.com/cve/CVE-2019-1319>)7.2High \n[CVE-2019-1364](<https://vulners.com/cve/CVE-2019-1364>)7.2High \n[CVE-2019-1341](<https://vulners.com/cve/CVE-2019-1341>)7.2High \n[CVE-2019-1365](<https://vulners.com/cve/CVE-2019-1365>)9.0Critical \n[CVE-2019-1359](<https://vulners.com/cve/CVE-2019-1359>)9.3Critical \n[CVE-2019-1342](<https://vulners.com/cve/CVE-2019-1342>)7.2High \n[CVE-2019-1358](<https://vulners.com/cve/CVE-2019-1358>)9.3Critical \n[CVE-2019-1363](<https://vulners.com/cve/CVE-2019-1363>)2.1Warning \n[CVE-2019-1325](<https://vulners.com/cve/CVE-2019-1325>)4.9Warning \n[CVE-2019-1371](<https://vulners.com/cve/CVE-2019-1371>)7.6Critical \n[CVE-2019-1238](<https://vulners.com/cve/CVE-2019-1238>)7.1High \n[CVE-2019-0608](<https://vulners.com/cve/CVE-2019-0608>)4.3Warning\n\n### *KB list*:\n[4520009](<http://support.microsoft.com/kb/4520009>) \n[4520003](<http://support.microsoft.com/kb/4520003>) \n[4520002](<http://support.microsoft.com/kb/4520002>) \n[4519976](<http://support.microsoft.com/kb/4519976>) \n[4519974](<http://support.microsoft.com/kb/4519974>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11872 Multiple vulnerabilities in Microsoft Products (ESU)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1166", "CVE-2019-1238", "CVE-2019-1315", "CVE-2019-1318", "CVE-2019-1319", "CVE-2019-1325", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1338", "CVE-2019-1339", "CVE-2019-1341", "CVE-2019-1342", "CVE-2019-1344", "CVE-2019-1346", "CVE-2019-1358", "CVE-2019-1359", "CVE-2019-1361", "CVE-2019-1362", "CVE-2019-1363", "CVE-2019-1364", "CVE-2019-1365", "CVE-2019-1371"], "modified": "2022-01-18T00:00:00", "id": "KLA11872", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11872/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-08T15:56:57", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, execute arbitrary code.\n\n### *Affected products*:\nChakraCore \nInternet Explorer 10 \nMicrosoft Edge (EdgeHTML-based) \nInternet Explorer 11 \nInternet Explorer 9\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1356](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1356>) \n[CVE-2019-1357](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1357>) \n[CVE-2019-1239](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1239>) \n[CVE-2019-1366](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1366>) \n[CVE-2019-1308](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1308>) \n[CVE-2019-1371](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1371>) \n[CVE-2019-1238](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1238>) \n[CVE-2019-1307](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1307>) \n[CVE-2019-1335](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1335>) \n[CVE-2019-0608](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-0608>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Internet Explorer](<https://threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/>)\n\n### *CVE-IDS*:\n[CVE-2019-1366](<https://vulners.com/cve/CVE-2019-1366>)7.6Critical \n[CVE-2019-1308](<https://vulners.com/cve/CVE-2019-1308>)7.6Critical \n[CVE-2019-1307](<https://vulners.com/cve/CVE-2019-1307>)7.6Critical \n[CVE-2019-1335](<https://vulners.com/cve/CVE-2019-1335>)7.6Critical \n[CVE-2019-1356](<https://vulners.com/cve/CVE-2019-1356>)4.3Warning \n[CVE-2019-1357](<https://vulners.com/cve/CVE-2019-1357>)4.3Warning \n[CVE-2019-1239](<https://vulners.com/cve/CVE-2019-1239>)7.6Critical \n[CVE-2019-1371](<https://vulners.com/cve/CVE-2019-1371>)7.6Critical \n[CVE-2019-1238](<https://vulners.com/cve/CVE-2019-1238>)7.1High \n[CVE-2019-0608](<https://vulners.com/cve/CVE-2019-0608>)4.3Warning\n\n### *KB list*:\n[4520010](<http://support.microsoft.com/kb/4520010>) \n[4520008](<http://support.microsoft.com/kb/4520008>) \n[4520007](<http://support.microsoft.com/kb/4520007>) \n[4519998](<http://support.microsoft.com/kb/4519998>) \n[4520005](<http://support.microsoft.com/kb/4520005>) \n[4517389](<http://support.microsoft.com/kb/4517389>) \n[4519338](<http://support.microsoft.com/kb/4519338>) \n[4520011](<http://support.microsoft.com/kb/4520011>) \n[4520004](<http://support.microsoft.com/kb/4520004>) \n[4519976](<http://support.microsoft.com/kb/4519976>) \n[4519974](<http://support.microsoft.com/kb/4519974>)\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11578 Multiple vulnerabilities in Microsoft Browsers", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 7.6, "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-0608", "CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1335", "CVE-2019-1356", "CVE-2019-1357", "CVE-2019-1366", "CVE-2019-1371"], "modified": "2020-07-22T00:00:00", "id": "KLA11578", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11578/", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-08T15:56:59", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nHigh\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges, execute arbitrary code.\n\n### *Affected products*:\nExcel Services \nMicrosoft Excel 2016 (32-bit edition) \nOffice Online Server \nMicrosoft Office 2016 (32-bit edition) \nMicrosoft Office 2019 for Mac \nMicrosoft SharePoint Enterprise Server 2013 Service Pack 1 \nMicrosoft Office 2013 Service Pack 1 (32-bit editions) \nMicrosoft Excel 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office 2016 for Mac \nMicrosoft Office 2016 (64-bit edition) \nMicrosoft Office 2013 Service Pack 1 (64-bit editions) \nMicrosoft Office 2013 RT Service Pack 1 \nMicrosoft Excel 2013 RT Service Pack 1 \nOffice 365 ProPlus for 32-bit Systems \nMicrosoft Office 2019 for 32-bit editions \nMicrosoft SharePoint Foundation 2010 Service Pack 2 \nMicrosoft SharePoint Foundation 2013 Service Pack 1 \nOffice 365 ProPlus for 64-bit Systems \nMicrosoft Excel 2013 Service Pack 1 (64-bit editions) \nMicrosoft Excel 2010 Service Pack 2 (32-bit editions) \nMicrosoft Office 2010 Service Pack 2 (64-bit editions) \nMicrosoft Office 2010 Service Pack 2 (32-bit editions) \nMicrosoft SharePoint Server 2019 \nMicrosoft Excel 2013 Service Pack 1 (32-bit editions) \nMicrosoft Office 2019 for 64-bit editions \nMicrosoft Excel 2016 (64-bit edition) \nMicrosoft SharePoint Enterprise Server 2016\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1070](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1070>) \n[CVE-2019-1329](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1329>) \n[CVE-2019-1328](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1328>) \n[CVE-2019-1331](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1331>) \n[CVE-2019-1327](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1327>) \n[CVE-2019-1330](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1330>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Office](<https://threats.kaspersky.com/en/product/Microsoft-Office/>)\n\n### *CVE-IDS*:\n[CVE-2019-1070](<https://vulners.com/cve/CVE-2019-1070>)3.5Warning \n[CVE-2019-1329](<https://vulners.com/cve/CVE-2019-1329>)3.5Warning \n[CVE-2019-1328](<https://vulners.com/cve/CVE-2019-1328>)3.5Warning \n[CVE-2019-1331](<https://vulners.com/cve/CVE-2019-1331>)9.3Critical \n[CVE-2019-1327](<https://vulners.com/cve/CVE-2019-1327>)9.3Critical \n[CVE-2019-1330](<https://vulners.com/cve/CVE-2019-1330>)4.0Warning\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[4484122](<http://support.microsoft.com/kb/4484122>) \n[4484111](<http://support.microsoft.com/kb/4484111>) \n[4475554](<http://support.microsoft.com/kb/4475554>) \n[4484110](<http://support.microsoft.com/kb/4484110>) \n[4475569](<http://support.microsoft.com/kb/4475569>) \n[4484131](<http://support.microsoft.com/kb/4484131>) \n[4475558](<http://support.microsoft.com/kb/4475558>) \n[4484130](<http://support.microsoft.com/kb/4484130>) \n[4462176](<http://support.microsoft.com/kb/4462176>) \n[4484112](<http://support.microsoft.com/kb/4484112>) \n[4484123](<http://support.microsoft.com/kb/4484123>) \n[4462215](<http://support.microsoft.com/kb/4462215>) \n[4475595](<http://support.microsoft.com/kb/4475595>) \n[4475608](<http://support.microsoft.com/kb/4475608>)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11577 Multiple vulnerability in Microsoft Office", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1070", "CVE-2019-1327", "CVE-2019-1328", "CVE-2019-1329", "CVE-2019-1330", "CVE-2019-1331"], "modified": "2020-06-03T00:00:00", "id": "KLA11577", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11577/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-08T15:57:01", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information.\n\n### *Affected products*:\nAzure App Service on Azure Stack \nOpen Enclave SDK \nWindows Azure Pack Web Sites V2\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1372](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1372>) \n[CVE-2019-1369](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1369>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Windows](<https://threats.kaspersky.com/en/product/Microsoft-Windows/>)\n\n### *CVE-IDS*:\n[CVE-2019-1369](<https://vulners.com/cve/CVE-2019-1369>)\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[4524964](<http://support.microsoft.com/kb/4524964>)", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 10.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11575 Multiple vulnerabilities in Microsoft Developer Tools", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1369", "CVE-2019-1372"], "modified": "2020-06-03T00:00:00", "id": "KLA11575", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11575/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-08T15:55:35", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nHigh\n\n### *Description*:\nInformation disclosure vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit this vulnerability to obtain sensitive information.\n\n### *Affected products*:\nSQL Server Management Studio 18.3.1 \nSQL Server Management Studio 18.3\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1376](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1376>) \n[CVE-2019-1313](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1313>) \n\n\n### *Impacts*:\nOSI \n\n### *Related products*:\n[Microsoft SQL Server](<https://threats.kaspersky.com/en/product/Microsoft-SQL-Server/>)\n\n### *CVE-IDS*:\n[CVE-2019-1376](<https://vulners.com/cve/CVE-2019-1376>)4.0Warning \n[CVE-2019-1313](<https://vulners.com/cve/CVE-2019-1313>)4.0Warning\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11654 Information disclosure vulnerabilities in Microsoft SQL Server", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1313", "CVE-2019-1376"], "modified": "2020-06-03T00:00:00", "id": "KLA11654", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11654/", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-02-08T15:55:44", "description": "### *Detect date*:\n10/08/2019\n\n### *Severity*:\nHigh\n\n### *Description*:\nA security feature bypass vulnerability was found in Microsoft Device. Malicious users can exploit this vulnerability to bypass security restrictions.\n\n### *Affected products*:\nWindows 10 Mobile\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-1314](<https://portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2019-1314>) \n\n\n### *Impacts*:\nSB \n\n### *Related products*:\n[Microsoft Windows](<https://threats.kaspersky.com/en/product/Microsoft-Windows/>)\n\n### *CVE-IDS*:\n[CVE-2019-1314](<https://vulners.com/cve/CVE-2019-1314>)4.6Warning\n\n### *Microsoft official advisories*:", "cvss3": {"exploitabilityScore": 0.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.8, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-10-08T00:00:00", "type": "kaspersky", "title": "KLA11643 SB vulnerability in Microsoft Device", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-1314"], "modified": "2020-06-03T00:00:00", "id": "KLA11643", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11643/", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2020-07-21T20:40:57", "description": "This host is missing a critical security\n update according to Microsoft KB4517389", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4517389)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1336", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1322", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1321", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1337", "CVE-2019-1359", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1365", "CVE-2019-1340", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1323", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1368", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1320", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815493", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815493", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815493\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\", \"CVE-2019-1311\",\n \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\", \"CVE-2019-1318\",\n \"CVE-2019-1319\", \"CVE-2019-1320\", \"CVE-2019-1321\", \"CVE-2019-1322\",\n \"CVE-2019-1323\", \"CVE-2019-1325\", \"CVE-2019-1326\", \"CVE-2019-1333\",\n \"CVE-2019-1334\", \"CVE-2019-1335\", \"CVE-2019-1336\", \"CVE-2019-1337\",\n \"CVE-2019-1339\", \"CVE-2019-1340\", \"CVE-2019-1341\", \"CVE-2019-1342\",\n \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1345\", \"CVE-2019-1346\",\n \"CVE-2019-1347\", \"CVE-2019-1356\", \"CVE-2019-1357\", \"CVE-2019-1358\",\n \"CVE-2019-1359\", \"CVE-2019-1365\", \"CVE-2019-1366\", \"CVE-2019-1367\",\n \"CVE-2019-1368\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4517389)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4517389\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle\n attacker is able to successfully bypass the NTLM MIC (Message Integrity Check)\n protection.\n\n - Chakra scripting engine improperly handles objects in memory in Microsoft Edge.\n\n - A spoofing vulnerability exists when Transport Layer Security (TLS) accesses\n non Extended Master Secret (EMS) sessions.\n\n - Microsoft Windows Update Client does not properly handle privileges.\n\n - Windows Error Reporting manager improperly handles process crashes.\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Scripting engine handles objects in memory in Internet Explorer.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions,\n elevate privileges and read privileged data across trust boundaries, create a\n denial of service condition and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1903 for 32-bit Systems\n\n - Microsoft Windows 10 Version 1903 for x64-based Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4517389\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"Schannel.dll\");\nif(!dllVer)\n exit(0);\n\nif(version_in_range(version:dllVer, test_version:\"10.0.18362.0\", test_version2:\"10.0.18362.417\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Schannel.dll\",\n file_version:dllVer, vulnerable_range:\"10.0.18362.0 - 10.0.18362.417\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:41:00", "description": "This host is missing a critical security\n update according to Microsoft KB4520004", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4520004)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1321", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1230", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1340", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1320", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815489", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815489", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815489\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1230\", \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\",\n \"CVE-2019-1311\", \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\",\n \"CVE-2019-1318\", \"CVE-2019-1319\", \"CVE-2019-1320\", \"CVE-2019-1321\",\n \"CVE-2019-1325\", \"CVE-2019-1326\", \"CVE-2019-1333\", \"CVE-2019-1334\",\n \"CVE-2019-1335\", \"CVE-2019-1339\", \"CVE-2019-1340\", \"CVE-2019-1341\",\n \"CVE-2019-1342\", \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1345\",\n \"CVE-2019-1346\", \"CVE-2019-1347\", \"CVE-2019-1356\", \"CVE-2019-1357\",\n \"CVE-2019-1358\", \"CVE-2019-1359\", \"CVE-2019-1366\", \"CVE-2019-1367\",\n \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4520004)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4520004\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle\n attacker is able to successfully bypass the NTLM MIC (Message Integrity Check)\n protection.\n\n - Chakra scripting engine improperly handles objects in memory in Microsoft Edge.\n\n - Windows Error Reporting (WER) improperly handles and executes files.\n\n - Windows kernel improperly handles objects in memory.\n\n - Windows Jet Database Engine improperly handles objects in memory.\n\n - Scripting engine improperly handles objects in memory in Internet Explorer.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions,\n elevate privileges and read privileged data across trust boundaries, create a\n denial of service condition and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1709 for x64-based Systems\n\n - Microsoft Windows 10 Version 1709 for 32-bit Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4520004\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0)\n exit(0);\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"Gdiplus.dll\");\nif(!dllVer)\n exit(0);\n\nif(version_in_range(version:dllVer, test_version:\"10.0.16299.0\", test_version2:\"10.0.16299.1447\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Gdiplus.dll\",\n file_version:dllVer, vulnerable_range:\"10.0.16299.0 - 10.0.16299.1447\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:50", "description": "This host is missing a critical security\n update according to Microsoft KB4519998", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4519998)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1365", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815708", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815708", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815708\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-1319\", \"CVE-2019-1325\", \"CVE-2019-0608\", \"CVE-2019-1060\",\n \"CVE-2019-1166\", \"CVE-2019-1365\", \"CVE-2019-1366\", \"CVE-2019-1371\",\n \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\", \"CVE-2019-1311\",\n \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\", \"CVE-2019-1318\",\n \"CVE-2019-1326\", \"CVE-2019-1333\", \"CVE-2019-1334\", \"CVE-2019-1335\",\n \"CVE-2019-1339\", \"CVE-2019-1341\", \"CVE-2019-1342\", \"CVE-2019-1343\",\n \"CVE-2019-1344\", \"CVE-2019-1345\", \"CVE-2019-1346\", \"CVE-2019-1347\",\n \"CVE-2019-1356\", \"CVE-2019-1357\", \"CVE-2019-1358\", \"CVE-2019-1359\",\n \"CVE-2019-1367\", \"CVE-2019-1192\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:43:20 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4519998)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4519998\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaw exists due to,\n\n - improper handling of objects in memory in Windows Jet Database Engine,\n Microsoft Edge, Windows Imaging API, Windows Code Integrity Module\n and Windows kernel.\n\n - improper handling of hard links in Windows Error Reporting manager,\n\n - improper parsing of HTTP content in Microsoft Browsers.\n\n - improper handling of privileges in Microsoft Windows Setup.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker to\n execute arbitrary code on a victim system, elevate privileges, obtain information\n to further compromise the user's system or cause denial of service condition.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1607 x32/x64\n\n - Microsoft Windows Server 2016\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4519998\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1, win2016:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\nfileVer = fetch_file_version(sysPath:sysPath, file_name:\"Mshtml.dll\");\nif(!fileVer)\n exit(0);\n\nif(version_in_range(version:fileVer, test_version:\"11.0.14393.0\", test_version2:\"11.0.14393.3268\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Mshtml.dll\",\n file_version:fileVer, vulnerable_range:\"11.0.14393.0 - 11.0.14393.3268\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:43", "description": "This host is missing a critical security\n update according to Microsoft KB4520010", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4520010)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1321", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1230", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1340", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815487", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815487", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815487\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1230\", \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\",\n \"CVE-2019-1311\", \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\",\n \"CVE-2019-1318\", \"CVE-2019-1319\", \"CVE-2019-1321\", \"CVE-2019-1325\",\n \"CVE-2019-1326\", \"CVE-2019-1333\", \"CVE-2019-1334\", \"CVE-2019-1335\",\n \"CVE-2019-1339\", \"CVE-2019-1340\", \"CVE-2019-1341\", \"CVE-2019-1342\",\n \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1345\", \"CVE-2019-1346\",\n \"CVE-2019-1347\", \"CVE-2019-1356\", \"CVE-2019-1357\", \"CVE-2019-1358\",\n \"CVE-2019-1359\", \"CVE-2019-1366\", \"CVE-2019-1367\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4520010)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4520010\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Microsoft XML Core Services MSXML parser improperly processes user input.\n\n - VBScript engine improperly handles objects in memory.\n\n - Windows Imaging API improperly handles objects in memory.\n\n - The 'umpo.dll' of the Power Service, improperly handles a Registry Restore\n Key function.\n\n - Windows improperly handles hard link.\n\n - Windows Error Reporting manager improperly handles hard links.\n\n - Windows CloudStore improperly handles file Discretionary Access Control List\n (DACL).\n\n - Windows Jet Database Engine improperly handles objects in memory.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions,\n elevate privileges and read privileged data across trust boundaries, create a\n denial of service condition and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1703 for x64-based Systems\n\n - Microsoft Windows 10 Version 1703 for 32-bit Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4520010\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"Wininet.dll\");\nif(!dllVer)\n exit(0);\n\nif(version_in_range(version:dllVer, test_version:\"11.0.15063.0\", test_version2:\"11.0.15063.2105\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Wininet.dll\",\n file_version:dllVer, vulnerable_range:\"11.0.15063.0 - 11.0.15063.2105\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:54", "description": "This host is missing a critical security\n update according to Microsoft KB4519338", "cvss3": {}, "published": "2019-10-10T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4519338)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1336", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1322", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1321", "CVE-2019-1371", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1337", "CVE-2019-1359", "CVE-2019-1230", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1365", "CVE-2019-1340", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1323", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1368", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1320", "CVE-2019-1239", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815497", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815497", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815497\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1230\", \"CVE-2019-1238\", \"CVE-2019-1239\", \"CVE-2019-1307\",\n \"CVE-2019-1308\", \"CVE-2019-1311\", \"CVE-2019-1315\", \"CVE-2019-1317\",\n \"CVE-2019-1318\", \"CVE-2019-1319\", \"CVE-2019-1320\", \"CVE-2019-1321\",\n \"CVE-2019-1322\", \"CVE-2019-1323\", \"CVE-2019-1325\", \"CVE-2019-1326\",\n \"CVE-2019-1333\", \"CVE-2019-1334\", \"CVE-2019-1335\", \"CVE-2019-1336\",\n \"CVE-2019-1337\", \"CVE-2019-1339\", \"CVE-2019-1340\", \"CVE-2019-1341\",\n \"CVE-2019-1342\", \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1345\",\n \"CVE-2019-1346\", \"CVE-2019-1347\", \"CVE-2019-1356\", \"CVE-2019-1357\",\n \"CVE-2019-1358\", \"CVE-2019-1359\", \"CVE-2019-1365\", \"CVE-2019-1366\",\n \"CVE-2019-1367\", \"CVE-2019-1368\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-10 14:23:24 +0530 (Thu, 10 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4519338)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4519338\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Microsoft XML Core Services MSXML parser improperly processes user input.\n\n - Windows Hyper-V Network Switch on a host operating system fails to properly\n validate input from an authenticated user on a guest operating system.\n\n - Windows kernel improperly handles objects in memory.\n\n - Windows Error Reporting (WER) improperly handles and executes files.\n\n - Microsoft Windows Update Client does not properly handle privileges.\n\n - Windows Error Reporting manager improperly handles hard links.\n\n - Microsoft browsers improperly handle requests of different origins.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code in kernel mode, obtain information to further compromise\n a user's system, elevate permissions and create a denial of service condition\n causing the target system to become unresponsive.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1809 for x64-based Systems\n\n - Microsoft Windows Server 2019\n\n - Microsoft Windows 10 Version 1809 for 32-bit Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-in/help/4519338\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1, win2019:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"Ntoskrnl.exe\");\nif(!dllVer)\n exit(0);\n\nif(version_in_range(version:dllVer, test_version:\"10.0.17763.0\", test_version2:\"10.0.17763.801\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Ntoskrnl.exe\",\n file_version:dllVer, vulnerable_range:\"10.0.17763.0 - 10.0.17763.801\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:52", "description": "This host is missing a critical security\n update according to Microsoft KB4520008", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4520008)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1307", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1356", "CVE-2019-1322", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1321", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1230", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1365", "CVE-2019-1340", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1345", "CVE-2019-1315", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1368", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1320", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815488", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815488", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815488\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1230\", \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\",\n \"CVE-2019-1311\", \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\",\n \"CVE-2019-1318\", \"CVE-2019-1319\", \"CVE-2019-1320\", \"CVE-2019-1321\",\n \"CVE-2019-1322\", \"CVE-2019-1325\", \"CVE-2019-1326\", \"CVE-2019-1333\",\n \"CVE-2019-1334\", \"CVE-2019-1335\", \"CVE-2019-1339\", \"CVE-2019-1340\",\n \"CVE-2019-1341\", \"CVE-2019-1342\", \"CVE-2019-1343\", \"CVE-2019-1344\",\n \"CVE-2019-1345\", \"CVE-2019-1346\", \"CVE-2019-1347\", \"CVE-2019-1356\",\n \"CVE-2019-1357\", \"CVE-2019-1358\", \"CVE-2019-1359\", \"CVE-2019-1365\",\n \"CVE-2019-1366\", \"CVE-2019-1367\", \"CVE-2019-1368\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4520008)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4520008\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Microsoft XML Core Services MSXML parser improperly processes user input.\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle\n attacker is able to successfully bypass the NTLM MIC (Message Integrity Check)\n protection.\n\n - Chakra scripting engine handles objects in memory in Microsoft Edge.\n\n - Windows improperly handles hard link.\n\n - Internet Explorer improperly accesses objects in memory.\n\n - Microsoft browsers improperly handle requests of different origins.\n\n - Windows improperly handles authentication requests..\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions,\n elevate privileges and read privileged data across trust boundaries, create a\n denial of service condition and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 Version 1803 for x64-based Systems\n\n - Microsoft Windows 10 Version 1803 for 32-bit Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4520008\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\nexeVer = fetch_file_version(sysPath:sysPath, file_name:\"Ntoskrnl.exe\");\nif(!exeVer)\n exit(0);\n\nif(version_in_range(version:exeVer, test_version:\"10.0.17134.0\", test_version2:\"10.0.17134.1066\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Ntoskrnl.exe\",\n file_version:exeVer, vulnerable_range:\"10.0.17134.0 - 10.0.17134.1066\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:47", "description": "This host is missing a critical security\n update according to Microsoft KB4519976", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4519976)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1362", "CVE-2019-1342", "CVE-2019-1319", "CVE-2019-1338", "CVE-2019-1318", "CVE-2019-1341", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1361", "CVE-2019-1371", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1365", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1315", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1339", "CVE-2019-1363", "CVE-2019-0608", "CVE-2019-1357", "CVE-2019-1364"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815710", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815710", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815710\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1166\", \"CVE-2019-1192\", \"CVE-2019-1238\",\n \"CVE-2019-1315\", \"CVE-2019-1318\", \"CVE-2019-1319\", \"CVE-2019-1325\",\n \"CVE-2019-1326\", \"CVE-2019-1333\", \"CVE-2019-1338\", \"CVE-2019-1339\",\n \"CVE-2019-1341\", \"CVE-2019-1342\", \"CVE-2019-1344\", \"CVE-2019-1346\",\n \"CVE-2019-1357\", \"CVE-2019-1358\", \"CVE-2019-1359\", \"CVE-2019-1361\",\n \"CVE-2019-1362\", \"CVE-2019-1363\", \"CVE-2019-1364\", \"CVE-2019-1365\",\n \"CVE-2019-1367\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 12:02:34 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4519976)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4519976\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the\n target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Improper parsing of HTTP content.\n\n - Improper handling of objects in memory in VBScript engine.\n\n - Improperly handling of hard links in Windows Error Reporting manager.\n\n - Improper handling of a Registry Restore Key function in 'umpo.dll' of\n Power Service.\n\n - Improper handling of process crash in Windows Error Reporting manager.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow\n an attacker to execute arbitrary code on a victim system, obtain information\n to further compromise the user's system, gain elevated privileges and disclose\n sensitive information or cause denial of service.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1\n\n - Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4519976\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) <= 0){\n exit(0);\n}\n\ndllPath = smb_get_system32root();\nif(!dllPath)\n exit(0);\n\nfileVer = fetch_file_version(sysPath:dllPath, file_name:\"Mshtml.dll\");\nif(!fileVer)\n exit(0);\n\nif(version_is_less(version:fileVer, test_version:\"11.0.9600.19507\")) {\n report = report_fixed_ver(file_checked:dllPath + \"\\Mshtml.dll\",\n file_version:fileVer, vulnerable_range:\"Less than 11.0.9600.19507\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:57", "description": "This host is missing a critical security\n update according to Microsoft KB4520005", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4520005)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1319", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1371", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1166", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1365", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1315", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815490", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815490", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815490\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1060\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1238\", \"CVE-2019-1311\", \"CVE-2019-1315\", \"CVE-2019-1318\",\n \"CVE-2019-1319\", \"CVE-2019-1325\", \"CVE-2019-1326\", \"CVE-2019-1333\",\n \"CVE-2019-1334\", \"CVE-2019-1339\", \"CVE-2019-1341\", \"CVE-2019-1342\",\n \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1346\", \"CVE-2019-1347\",\n \"CVE-2019-1357\", \"CVE-2019-1358\", \"CVE-2019-1359\", \"CVE-2019-1365\",\n \"CVE-2019-1367\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4520005)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4520005\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Microsoft XML Core Services MSXML parser processes user input.\n\n - A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle\n attacker is able to successfully bypass the NTLM MIC (Message Integrity Check)\n protection.\n\n - An error in windows redirected drive buffering system (rdbss.sys) when the\n operating system improperly handles specific local calls.\n\n - Windows Error Reporting (WER) improperly handles and executes files.\n\n - Windows Error Reporting manager improperly handles hard links.\n\n - Remote Desktop Protocol (RDP) improperly handles connection requests.\n\n - Windows Code Integrity Module improperly handles objects in memory.\n\n - Windows Jet Database Engine improperly handles objects in memory.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions,\n elevate privileges and read privileged data across trust boundaries, create a\n denial of service condition and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 8.1 for 32-bit/x64-based systems\n\n - Microsoft Windows Server 2012 R2\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4520005\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win8_1:1, win8_1x64:1, win2012R2:1) <= 0){\n exit(0);\n}\n\nsysPath = smb_get_system32root();\nif(!sysPath)\n exit(0);\n\ndllVer = fetch_file_version(sysPath:sysPath, file_name:\"Urlmon.dll\");\nif(!dllVer)\n exit(0);\n\nif(version_is_less(version:dllVer, test_version:\"11.0.9600.19507\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Urlmon.dll\",\n file_version:dllVer, vulnerable_range:\"Less than 11.0.9600.19507\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T20:40:58", "description": "This host is missing a critical security\n update according to Microsoft KB4520011", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Multiple Vulnerabilities (KB4520011)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1342", "CVE-2019-1307", "CVE-2019-1319", "CVE-2018-12126", "CVE-2019-1060", "CVE-2019-1318", "CVE-2019-1366", "CVE-2019-1341", "CVE-2019-1347", "CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1371", "CVE-2019-1316", "CVE-2019-1238", "CVE-2019-1326", "CVE-2019-1359", "CVE-2019-1166", "CVE-2018-12127", "CVE-2019-1358", "CVE-2019-1311", "CVE-2019-1346", "CVE-2019-1344", "CVE-2019-1343", "CVE-2019-1315", "CVE-2019-1335", "CVE-2019-1333", "CVE-2019-1325", "CVE-2019-1308", "CVE-2019-1334", "CVE-2019-1339", "CVE-2019-1317", "CVE-2019-11091", "CVE-2019-0608", "CVE-2019-1357", "CVE-2018-12130"], "modified": "2020-07-17T00:00:00", "id": "OPENVAS:1361412562310815486", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815486", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815486\");\n script_version(\"2020-07-17T05:57:41+0000\");\n script_cve_id(\"CVE-2018-12126\", \"CVE-2018-12127\", \"CVE-2018-12130\", \"CVE-2019-0608\",\n \"CVE-2019-1060\", \"CVE-2019-11091\", \"CVE-2019-1166\", \"CVE-2019-1192\",\n \"CVE-2019-1238\", \"CVE-2019-1307\", \"CVE-2019-1308\", \"CVE-2019-1311\",\n \"CVE-2019-1315\", \"CVE-2019-1316\", \"CVE-2019-1317\", \"CVE-2019-1318\",\n \"CVE-2019-1319\", \"CVE-2019-1325\", \"CVE-2019-1326\", \"CVE-2019-1333\",\n \"CVE-2019-1334\", \"CVE-2019-1335\", \"CVE-2019-1339\", \"CVE-2019-1341\",\n \"CVE-2019-1342\", \"CVE-2019-1343\", \"CVE-2019-1344\", \"CVE-2019-1346\",\n \"CVE-2019-1347\", \"CVE-2019-1357\", \"CVE-2019-1358\", \"CVE-2019-1359\",\n \"CVE-2019-1366\", \"CVE-2019-1367\", \"CVE-2019-1371\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-07-17 05:57:41 +0000 (Fri, 17 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Multiple Vulnerabilities (KB4520011)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4520011\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Speculative execution side channel vulnerabilities known as Microarchitectural\n Data Sampling.\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - Chakra scripting engine improperly handles objects in memory in Microsoft Edge.\n\n - Windows Imaging API improperly handles objects in memory.\n\n - The 'umpo.dll' of the Power Service, improperly handles a Registry Restore\n Key function.\n\n - Windows Error Reporting manager improperly handles hard links.\n\n - Internet Explorer improperly accesses objects in memory.\n\n Please see the references for more information about the vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, elevate privileges and read\n privileged data across trust boundaries, create a denial of service condition\n and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"- Microsoft Windows 10 for x64-based Systems\n\n - Microsoft Windows 10 for 32-bit Systems\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4520011\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win10:1, win10x64:1) <= 0)\n exit(0);\n\nif(!sysPath = smb_get_system32root())\n exit(0);\n\nif(!edgeVer = fetch_file_version(sysPath:sysPath, file_name:\"Edgehtml.dll\"))\n exit(0);\n\nif(version_in_range(version:edgeVer, test_version:\"11.0.10240.0\", test_version2:\"11.0.10240.18365\")) {\n report = report_fixed_ver(file_checked:sysPath + \"\\Edgehtml.dll\",\n file_version:edgeVer, vulnerable_range:\"11.0.10240.0 - 11.0.10240.18365\");\n security_message(data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:17", "description": "This host is missing a critical security\n update according to Microsoft KB4519974", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Windows Server 2012 Multiple Vulnerabilities (KB4519974)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1367", "CVE-2019-1192", "CVE-2019-1371", "CVE-2019-1238", "CVE-2019-0608", "CVE-2019-1357"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815492", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815492", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:microsoft:ie\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815492\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-0608\", \"CVE-2019-1238\", \"CVE-2019-1357\", \"CVE-2019-1371\",\n \"CVE-2019-1367\", \"CVE-2019-1192\");\n script_tag(name:\"cvss_base\", value:\"7.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:H/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 10:13:33 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Windows Server 2012 Multiple Vulnerabilities (KB4519974)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update according to Microsoft KB4519974\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - Microsoft Browsers does not properly parse HTTP content.\n\n - VBScript engine improperly handles objects in memory.\n\n - Microsoft Browsers improperly handle browser cookies.\n\n - Internet Explorer improperly accesses objects in memory.\n\n - Scripting engine handles objects in memory in Internet Explorer.\n\n - Microsoft browsers improperly handle requests of different origins.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code on the client machine, bypass security restrictions\n and conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Windows Server 2012.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4519974\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_reg_service_pack.nasl\", \"gb_ms_ie_detect.nasl\");\n script_require_ports(139, 445);\n script_mandatory_keys(\"SMB/WindowsVersion\", \"MS/IE/Version\");\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(hotfix_check_sp(win2012:1) <= 0){\n exit(0);\n}\n\nieVer = get_app_version(cpe:CPE);\nif(!ieVer || ieVer !~ \"^11\\.\"){\n exit(0);\n}\n\niePath = smb_get_system32root();\nif(!iePath ){\n exit(0);\n}\n\niedllVer = fetch_file_version(sysPath:iePath, file_name:\"Mshtml.dll\");\nif(!iedllVer){\n exit(0);\n}\n\nif(version_is_less(version:iedllVer, test_version:\"11.0.9600.19502\"))\n{\n report = report_fixed_ver(file_checked:iePath + \"\\Mshtml.dll\",\n file_version:iedllVer, vulnerable_range:\"Less than 11.0.9600.19502\");\n security_message(data:report);\n exit(0);\n}\nexit(0);\n", "cvss": {"score": 7.6, "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:16", "description": "This host is missing an important security\n update according to Microsoft KB4484123", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB4484123)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331", "CVE-2019-1327"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815705", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815705", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815705\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 09:28:52 +0530 (Wed, 09 Oct 2019)\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_name(\"Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB4484123)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4484123\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist in Microsoft Excel due to\n improper handling of objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker to\n run arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Excel 2013 Service Pack 1.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4484123\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"SMB/Office/Excel/Version\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nexcelVer = get_kb_item(\"SMB/Office/Excel/Version\");\nif(!excelVer){\n exit(0);\n}\n\nexcelPath = get_kb_item(\"SMB/Office/Excel/Install/Path\");\nif(!excelPath){\n excelPath = \"Unable to fetch the install path\";\n}\n\nif(excelVer =~ \"^15\\.\" && version_is_less(version:excelVer, test_version:\"15.0.5179.1000\"))\n{\n report = report_fixed_ver(file_checked:excelPath + \"Excel.exe\",\n file_version:excelVer, vulnerable_range:\"15.0 - 15.0.5179.0999\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:26", "description": "This host is missing an important security\n update according to Microsoft KB4484112", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Excel 2016 Multiple Vulnerabilities (KB4484112)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331", "CVE-2019-1327"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815635", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815635", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815635\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 11:10:35 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Excel 2016 Multiple Vulnerabilities (KB4484112)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4484112\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to multiple errors\n in Microsoft Excel software when the software fails to properly handle objects\n in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker to\n run arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Excel 2016.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the\n references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4484112\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"SMB/Office/Excel/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nexcelVer = get_kb_item(\"SMB/Office/Excel/Version\");\nif(!excelVer){\n exit(0);\n}\n\nexcelPath = get_kb_item(\"SMB/Office/Excel/Install/Path\");\nif(!excelPath){\n excelPath = \"Unable to fetch the install path\";\n}\n\nif(version_in_range(version:excelVer, test_version:\"16.0\", test_version2:\"16.0.4912.0999\"))\n{\n report = report_fixed_ver(file_checked:excelPath + \"Excel.exe\",\n file_version:excelVer, vulnerable_range:\"16.0 - 16.0.4912.0999\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:30", "description": "This host is missing an important security\n update according to Microsoft KB4484130", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Excel 2010 Service Pack 2 Multiple Vulnerabilities (KB4484130)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331", "CVE-2019-1327"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815707", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815707", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815707\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 09:03:47 +0530 (Wed, 09 Oct 2019)\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_name(\"Microsoft Excel 2010 Service Pack 2 Multiple Vulnerabilities (KB4484130)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4484130\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw exists in Microsoft Excel software\n when the software fails to properly handle objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker to\n execute arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Excel 2010 Service Pack 2.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4484130/security-update-for-excel-2010-october-8-2019\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"SMB/Office/Excel/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nexcelVer = get_kb_item(\"SMB/Office/Excel/Version\");\nif(!excelVer){\n exit(0);\n}\n\nexcelPath = get_kb_item(\"SMB/Office/Excel/Install/Path\");\nif(!excelPath){\n excelPath = \"Unable to fetch the install path\";\n}\n\nif(version_in_range(version:excelVer, test_version:\"14.0\", test_version2:\"14.0.7239.4999\"))\n{\n report = report_fixed_ver(file_checked:excelPath + \"Excel.exe\",\n file_version:excelVer, vulnerable_range:\"14.0 - 14.0.7239.4999\");\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:13", "description": "This host is missing a critical security\n update for Microsoft Office 2016 on Mac OSX according to\n Microsoft security update October 2019", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Office Multiple Remote Code Execution Vulnerabilities Oct19 (Mac OS X)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331", "CVE-2019-1327"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815494", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815494", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815494\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1327\", \"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 18:53:41 +0530 (Wed, 09 Oct 2019)\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_name(\"Microsoft Office Multiple Remote Code Execution Vulnerabilities Oct19 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"This host is missing a critical security\n update for Microsoft Office 2016 on Mac OSX according to\n Microsoft security update October 2019\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists when the Excel software\n fails to properly handle objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Office 2016 and Office 2019 on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to latest version provided by vendor.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://docs.microsoft.com/en-us/officeupdates/release-notes-office-2016-mac\");\n script_xref(name:\"URL\", value:\"https://docs.microsoft.com/en-us/officeupdates/update-history-office-for-mac\");\n script_xref(name:\"URL\", value:\"https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1327\");\n script_xref(name:\"URL\", value:\"https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1331\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gb_microsoft_office_detect_macosx.nasl\");\n script_mandatory_keys(\"MS/Office/MacOSX/Ver\");\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nif(!offVer = get_kb_item(\"MS/Office/MacOSX/Ver\")){\n exit(0);\n}\n\nif(offVer =~ \"^1[56]\\.\")\n{\n if(version_is_less_equal(version:offVer, test_version:\"16.16.14\")||\n version_in_range(version:offVer, test_version:\"16.17.0\", test_version2:\"16.29.1\"))\n {\n report = report_fixed_ver(installed_version:offVer, fixed_version:\"Upgrade to latest version provided by vendor\");\n security_message(data:report);\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:32", "description": "This host is missing an important security\n update according to Microsoft Office Click-to-Run updates.", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities-Oct19", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331", "CVE-2019-1327"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815637", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815637", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815637\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1331\", \"CVE-2019-1327\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 11:10:35 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities-Oct19\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft Office Click-to-Run updates.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to multiple errors\n in Microsoft Excel software when the software fails to properly handle objects\n in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to run arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Office 365 (2016 Click-to-Run).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see\n the references for more information.\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"gb_ms_office_click2run_detect_win.nasl\");\n script_mandatory_keys(\"MS/Off/C2R/Ver\", \"MS/Office/C2R/UpdateChannel\");\n exit(0);\n}\n\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nofficeVer = get_kb_item(\"MS/Off/C2R/Ver\");\nif(!officeVer || officeVer !~ \"^16\\.\"){\n exit(0);\n}\n\nUpdateChannel = get_kb_item(\"MS/Office/C2R/UpdateChannel\");\nofficePath = get_kb_item(\"MS/Off/C2R/InstallPath\");\n\n## 1909 (Build 12026.20320)\nif(UpdateChannel == \"Monthly Channel\")\n{\n if(version_is_less(version:officeVer, test_version:\"16.0.12026.20320\")){\n fix = \"1909 (Build 12026.20320)\";\n }\n}\n\n## 1908 (Build 11929.20388)\nelse if(UpdateChannel == \"Semi-Annual Channel (Targeted)\")\n{\n if(version_is_less(version:officeVer, test_version:\"16.0.11929.20388\")){\n fix = \"1908 (Build 11929.20388)\";\n }\n}\n\n## 1902 (Build 11328.20438)\n## 1808 (Build 10730.20386)\nelse if(UpdateChannel == \"Semi-Annual Channel\")\n{\n if(version_is_less(version:officeVer, test_version:\"16.0.10730.20386\")){\n fix = \"1808 (Build 10730.20386)\";\n }\n\n else if(version_in_range(version:officeVer, test_version:\"16.0.11328\", test_version2:\"16.0.11328.20437\")){\n fix = \"1902 (Build 11328.20438)\";\n }\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:officeVer, fixed_version:fix, install_path:officePath);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:12", "description": "This host is missing an important security\n update according to Microsoft KB4475558", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Office 2013 Service Pack 1 Multiple Vulnerabilities (KB4475558)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815706", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815706", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815706\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 09:36:54 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Office 2013 Service Pack 1 Multiple Vulnerabilities (KB4475558)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4475558\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw exists when Microsoft Office\n fails to properly handle objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to execute arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Office 2013 Service Pack 1.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4475558\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"MS/Office/Ver\");\n script_require_ports(139, 445);\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(!os_arch = get_kb_item(\"SMB/Windows/Arch\")){\n exit(0);\n}\n\nif(\"x86\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n}\nelse if(\"x64\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\",\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n}\n\nforeach key(key_list)\n{\n msPath = registry_get_sz(key:key, item:\"ProgramFilesDir\");\n if(msPath)\n {\n offPath = msPath + \"\\Microsoft Office\\Office15\";\n msdllVer = fetch_file_version(sysPath:offPath, file_name:\"graph.exe\");\n\n if(msdllVer && msdllVer =~ \"^15\\.\")\n {\n if(version_is_less(version:msdllVer, test_version:\"15.0.5179.1000\"))\n {\n report = report_fixed_ver( file_checked:offPath + \"\\graph.exe\",\n file_version:msdllVer, vulnerable_range:\"15.0 - 15.0.5179.0999\");\n security_message(data:report);\n exit(0);\n }\n }\n }\n}\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:14", "description": "This host is missing an important security\n update according to Microsoft KB4475554", "cvss3": {}, "published": "2019-10-09T00:00:00", "type": "openvas", "title": "Microsoft Office 2016 Remote Code Execution Vulnerability (KB4475554)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815636", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815636", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815636\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-09 11:10:35 +0530 (Wed, 09 Oct 2019)\");\n script_name(\"Microsoft Office 2016 Remote Code Execution Vulnerability (KB4475554)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4475554\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw exists due to an error in Microsoft\n Excel software when the software fails to properly handle objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n who successfully exploited the vulnerability to run arbitrary code in the context\n of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Office 2016.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4475554\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"MS/Office/Ver\");\n script_require_ports(139, 445);\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nofficeVer = get_kb_item(\"MS/Office/Ver\");\nif(!officeVer){\n exit(0);\n}\n\nif(officeVer =~ \"^16\\.\")\n{\n os_arch = get_kb_item(\"SMB/Windows/Arch\");\n if(\"x86\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n }\n else if(\"x64\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\",\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n }\n\n foreach key(key_list)\n {\n propath = registry_get_sz(key:key, item:\"ProgramFilesDir\");\n if(propath)\n {\n offPath = propath + \"\\Microsoft Office\\root\\Office16\";\n offexeVer = fetch_file_version(sysPath:offPath, file_name:\"graph.exe\");\n if(!offexeVer){\n continue ;\n }\n if(offexeVer =~ \"^16\\.\" && version_is_less(version:offexeVer, test_version:\"16.0.4912.1000\"))\n {\n report = report_fixed_ver(file_checked:offPath + \"\\graph.exe\",\n file_version:offexeVer, vulnerable_range:\"16.0 - 16.0.4912.0999\");\n security_message(data:report);\n exit(0);\n }\n }\n }\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-06-05T16:27:17", "description": "This host is missing an important security\n update according to Microsoft KB4475569", "cvss3": {}, "published": "2019-04-10T00:00:00", "type": "openvas", "title": "Microsoft Office 2010 Service Pack 2 Remote Code Execution Vulnerability (KB4475569)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-1331"], "modified": "2020-06-04T00:00:00", "id": "OPENVAS:1361412562310815704", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815704", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815704\");\n script_version(\"2020-06-04T09:02:37+0000\");\n script_cve_id(\"CVE-2019-1331\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-06-04 09:02:37 +0000 (Thu, 04 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-04-10 11:03:22 +0530 (Wed, 10 Apr 2019)\");\n script_name(\"Microsoft Office 2010 Service Pack 2 Remote Code Execution Vulnerability (KB4475569)\");\n\n script_tag(name:\"summary\", value:\"This host is missing an important security\n update according to Microsoft KB4475569\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"The flaw exists when Microsoft Office\n fails to properly handle objects in memory.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow an attacker\n to execute arbitrary code in the context of the current user.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Office 2010 Service Pack 2.\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.microsoft.com/en-us/help/4475569/\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_office_products_version_900032.nasl\");\n script_mandatory_keys(\"MS/Office/Ver\");\n script_require_ports(139, 445);\n exit(0);\n}\n\n\ninclude(\"smb_nt.inc\");\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_smb_func.inc\");\n\noffVer = get_kb_item(\"MS/Office/Ver\");\nif(!offVer|| offVer !~ \"^14\\.\"){\n exit(0);\n}\n\nif(!os_arch = get_kb_item(\"SMB/Windows/Arch\")){\n exit(0);\n}\n\nif(\"x86\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n}\nelse if(\"x64\" >< os_arch){\n key_list = make_list(\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\",\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\");\n}\n\nforeach key(key_list)\n{\n commonpath = registry_get_sz(key:key, item:\"ProgramFilesDir\");\n if(!commonpath){\n continue;\n }\n\n offPath = commonpath + \"\\Microsoft Office\\Office14\";\n\n offexeVer = fetch_file_version(sysPath:offPath, file_name:\"graph.exe\");\n\n if(offexeVer && version_in_range(version:offexeVer, test_version:\"14.0\", test_version2:\"14.0.7239.4999\"))\n {\n report = report_fixed_ver(file_checked:offPath + \"\\graph.exe\",\n file_version:offexeVer, vulnerable_range:\"14.0 - 14.0.7239.4999\");\n security_message(data:report);\n exit(0);\n }\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "threatpost": [{"lastseen": "2020-09-15T22:21:36", "description": "Microsoft released patches for nine critical vulnerabilities as part of its October Patch Tuesday security update, including one for a Remote Desktop bug that could allow a remote attacker to execute code on victims\u2019 machines.\n\nOverall, Microsoft issued fixes for 59 vulnerabilities \u2013 including nine critical, 49 important and one moderate in severity.\n\n\u201cThis month, the Microsoft release is on the smaller side, with security patches for 59 CVEs and no new advisories,\u201d said Dustin Childs, with the Zero Day Initiative. \u201cThe updates cover Microsoft Windows, Internet Explorer, Edge (EdgeHTML-based), ChakraCore, Microsoft Office and Microsoft Office Services and Web Apps, SQL Server Management Studio, Microsoft Dynamics 365, Windows Update Assistant and Open Source Software,\u201d he wrote in [his breakdown of Microsoft Patch Tuesday security updates](<https://www.zerodayinitiative.com/blog/2019/10/8/the-october-security-update-review>).\n\n[![](https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg)](<https://threatpost.com/newsletter-sign/>)\n\nOne of the critical flaws highlighted by Childs includes a troublesome remote code execution vulnerability ([CVE-2019-1333](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1333>)) that \u201cexists in the Windows Remote Desktop Client when a user connects to a malicious server.\u201d\n\nThe flaw specifically involves Remote Desktop client machines that connect to servers via Remote Desktop Protocol (RDP). RDP is a protocol offered by Microsoft \u2013 and used by thousands of enterprises globally \u2013 that allows workers to remotely connect their client machines to servers in order to connect to corporate resources. Remote Desktop clients installed on user machines allow them to connect to a remote server host using the RDP protocol. The vulnerability specifically exists when a RDP client connects to a malicious RDP server.\n\nIn order for the attacker to exploit the vulnerability, an attacker must first compromise a legitimate RDP server by hosting malicious code on it. Next, they must convince the user of a client machine to connect to the server (likely through social engineering). If an attacker is successful, and convinces a client user to connect to the malicious server, he can then remotely send commands to the victim\u2019s machine to installing programs, view and chang data and create new accounts with full user rights, Microsoft said.\n\nVulnerabilities [in Windows Remote Desktop](<https://threatpost.com/wormable-remote-desktop-bugs-august-patch-tuesday/147302/>) continue to plague Microsoft. In July, an infamous critical vulnerability CVE- 2019-0708) was disclosed. The flaw, [called BlueKeep](<https://threatpost.com/fearing-wannacry-level-danger-enterprises-wrestle-with-bluekeep/146727/>), was highly wormable and enabled remote code execution.\n\nHowever, luckily \u201cunlike the infamous BlueKeep RDP vulnerability, (CVE-2019-1333) requires user interaction for an attack to be successful,\u201d said Robert Foggia with Trustwave [in an analysis](<https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/patch-tuesday-october-2019/>). \u201cAn attacker could exploit this vulnerability by convincing a victim to connect to a malicious RDP server.\n\nDespite that, Microsoft still thinks CVE-2019-1333 is a high-risk flaw, [ranking it](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1333>) on its \u201cexploitability index\u201d tool as a 1 out of 3, meaning that \u201cexploitation is more likely.\u201d To fix the flaw, Microsoft said that it corrected \u201chow the Windows Remote Desktop Client handles connection requests.\u201d\n\nOn Tuesday, Microsoft also issued an \u201cimportant\u201d fix for a denial-of-service flaw (CVE-2019-1326) in RDP. An attacker could exploit this flaw by connecting to a server using RDP and sending the server specially crafted requests. The requests would cause the RDP service on the vulnerable server to crash.\n\n## Other Critical Flaws\n\nOther critical vulnerabilities of note include two remote code execution flaws (CVE-2019-1238, CVE-2019-1239) in VBScript, the language developed by Microsoft that is modeled on Visual Basic. The vulnerabilities stem from the way VBScript handles memory, and could be exploited to execute arbitrary code on victim\u2019s machine. In order to exploit the flaw, a bad actor would first need to trick users into visiting a specially crafted, malicious website through Internet Explorer.\n\nFour critical memory corruption flaws (CVE-2019-1307, CVE-2019-1308, CVE-2019-1335 and CVE-2019-1366) were patched in the Chakra Scripting Engine, a JavaScript engine developed by Microsoft for its Microsoft Edge web browser.\n\n\u201cAn attacker could use these bugs to corrupt memory on the victim machine in a way that would allow them to remotely execute arbitrary code,\u201d according to Jon Munshaw with Cisco Talos [in an analysis](<https://blog.talosintelligence.com/2019/10/microsoft-patch-tuesday-oct-2019.html>). \u201cA user could trigger these vulnerabilities by visiting a specially crafted, malicious website in Edge.\u201d\n\nAnd, Microsoft patched an elevation of privilege flaw in Azure Stack ([CVE-2019-1372](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372>)). This vulnerability stems from the Azure App Service, which fails to properly check the length of a buffer before copying memory to it. That could result in an attacker exploiting this vulnerability \u201cto copy any function run by the user, thereby executing code in the context of NT AUTHORITY/system, which could allow the attacker to escape a sandbox,\u201d according to [Microsoft\u2019s advisory.](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1372>)\n\nUnlike its [September](<https://threatpost.com/microsoft-addresses-two-zero-days-under-active-attack/148185/>) and [August](<https://threatpost.com/microsoft-addresses-two-zero-days-under-active-attack/148185/>) Patch Tuesday releases, there are no zero days in this most recent update; Microsoft said that it has not yet seen any of the vulnerabilities exploited in the wild.\n\n**_What are the top cyber security issues associated with privileged account access and credential governance? Experts from Thycotic will discuss during our upcoming free _**[**_Threatpost webinar_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_, \u201cHackers and Security Pros: Where They Agree & Disagree When It Comes to Your Privileged Access Security.\u201d _**[**_Click here to register_**](<https://register.gotowebinar.com/register/9029717654543174147?source=ART>)**_._**\n", "cvss3": {}, "published": "2019-10-08T19:55:56", "type": "threatpost", "title": "Critical Microsoft Remote Desktop Flaw Fixed in Security Update", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2019-1238", "CVE-2019-1239", "CVE-2019-1307", "CVE-2019-1308", "CVE-2019-1326", "CVE-2019-1333", "CVE-2019-1335", "CVE-2019-1366", "CVE-2019-1372", "CVE-2020-4703", "CVE-2020-4711"], "modified": "2019-10-08T19:55:56", "id": "THREATPOST:D22DCF190C71B12772E59B68DFA9CCD0", "href": "https://threatpost.com/critical-microsoft-remote-desktop-flaw-fixed-in-security-update/148982/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "mskb": [{"lastseen": "2023-02-16T11:00:53", "description": "None\n## Summary\n\nThis article describes a security update for Internet Explorer. This update resolves the security issues that are described in the following articles:\n\n * [CVE-2019-1371 | Internet Explorer Memory Corruption Vulnerability](<https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-1371>)\n * [CVE-2019-1357 | Microsoft Browser Spoofing Vulnerability](<https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-1357>)\n * [CVE-2019-0608 | Microsoft Edge Spoofing Vulnerability](<https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0608>)\n * [CVE-2019-1060 | VBScript Remote Code Execution Vulnerability](<https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-1060>)\n * [CVE-2019-1238 | VBScript Remote Code Execution Vulnerability](<https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-1238>)\nAdditionally, see the following articles for more information about this cumulative security update:\n * Windows Server 2008 SP2 update history\n * Windows 7 SP1 and Windows Server 2008 R2 SP1 update history\n * Windows Server 2012 update history\n * Windows 8.1 and Windows Server 2012 R2 update history\n**Important **\n\n * Except for Internet Explorer 11 on Windows Server 2012, the fixes that are included in this Security Update for Internet Explorer (KB 4519974) are also included in the October 2019 Security Monthly Quality Rollup. Installing either the Security Update for Internet Explorer or the Security Monthly Quality Rollup installs the fixes that are in this update.\n * To obtain this update for Internet Explorer 11 on Server 2012, you must install this Security Update for Internet Explorer (KB 4519974). This update is not included in any Security Monthly Quality Rollup or Security Only Quality Update. For Internet Explorer 10 on Windows Server 2012, other called-out installation methods are applicable.\n * If you use update management processes other than Windows Update, and you automatically approve all security updates classifications for deployment, this Security Update for Internet Explorer (KB 4519974), the October 2019 Security Only Quality Update, and the October 2019 Security Monthly Quality Rollup are deployed. We recommend that you review your update deployment rules to make sure that the desired updates are deployed.\n * Except for Internet Explorer 11 on Windows Server 2012, this Security Update for Internet Explorer is not applicable for installation on a computer on which the Security Monthly Quality Rollup or the Preview of Monthly Quality Rollup from September 2019 (or a later month) is already installed. This is because those updates contain all the fixes that are in this security update for Internet Explorer.\n * If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see [Add language packs to Windows](<https://technet.microsoft.com/library/hh825699>).\n\n## How to get and install this update\n\n**Before installing this update**You must have the following updates installed and restart the device before you install this update (KB 4524135). Installing these updates improves the reliability of the update process and mitigates potential issues while installing this update.\n\n * Servicing stack update (SSU) ([KB4490628](<https://support.microsoft.com/help/4490628>)) or a later SSU update. If you use Windows Update, the SSU will be offered to you automatically. To get the standalone package for the SSU, search for it in the [Microsoft Update Catalog](<http://www.catalog.update.microsoft.com/home.aspx>).\n * SHA-2 update ([KB4474419](<https://support.microsoft.com/help/4474419>)) released September 10, 2019. If you use Windows Update, the latest SHA-2 update will be offered to you automatically. For more information on SHA-2 updates, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](<https://support.microsoft.com/help/4472027>).\nAfter these updates are installed, we strongly recommend that you also install the latest servicing stack update (SSU) ([KB4516655](<https://support.microsoft.com/help/4516655>)). If you are using Windows Update, the latest SSU will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the [Microsoft Update Catalog](<https://catalog.update.microsoft.com>). **Install this update**To install this update, use one of the following release channels.**Release Channel**| **Available**| **Next Step** \n---|---|--- \nWindows Update and Microsoft Update| Yes| None. This update will be downloaded and installed automatically from Windows Update for the following versions:\n\n * Internet Explorer 11 for Windows Server 2012 and Windows Embedded 8 Standard\n * Internet Explorer 8 for Windows Server 2008 SP2\nFor all other versions, see the other options below. \nMicrosoft Update Catalog| Yes| To get the standalone package for this update, go to the [Microsoft Update Catalog](<http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4524135>) website. \nWindows Server Update Services (WSUS)| Yes| This update will automatically synchronize with WSUS if you configure **Products and Classifications** as follows:**Product**: Windows Server 2008 Service Pack 2, Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, Windows Server 2012, Windows Embedded 8 Standard, Windows 8.1, Windows Server 2012 R2**Classification**: Security Updates \n \n## Known issues in this security update\n\nMicrosoft is not currently aware of any issues with this update.\n\n## Deployment information\n\nFor deployment details for this security update, see the following article in the Microsoft Knowledge Base:[Security update deployment information: October 8, 2019](<https://support.microsoft.com/help/20191008>)\n\n## File information\n\n### File attributes\n\nThe English (United States) version of this software update installs files that have the attributes that are listed in the following tables.**Note** The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.\n\n#### Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2\n\n#### Windows Server 2012\n\n \nWindows 7 and Windows Server 2008 R2 \n\n#### Windows Server 2008\n\n## File verification\n\n## File hash information\n\nFile name| SHA1 hash| SHA256 hash \n---|---|--- \nWindows8.1-KB4519974-x86.msu| E6EC68645FB16A57C0890FD33FA3C3B6F9705908| 26CD477B4B8E0C651431AB6359C8B8DDE9111877A4B711D470C024AAA65C8E26 \nWindows8.1-KB4519974-arm.msu| CD0F3665500BB8A63A079BEA7A7C88163099285F| 3232474F7E13E08CC1E95EF0DEB6AA65225AB59667E5B7DB104D866BBCBAFCFB \nWindows8.1-KB4519974-x64.msu| A55C9959A450546C9C3E5779DDDDB34C1CFB294E| 6AE98FD36070C5D4C3BD03779924F2484C4D96C0F680B762152DE16CEF5DC226 \nIE11-Windows6.2-KB4519974-X86.msu| 0567E7FA3BDF11AD45C4B2CE513F460923C32B0E| 0DDFC9A557D4EB94D3BF46488F484D111F2D2330EB33CEFAB7945314B1767EAC \nIE11-Windows6.2-KB4519974-X64.msu| 23147DD46E90A3A5BC1BC4807D9C58ACE4CADEC8| 4040DDD154E0D6BF3A94647AE69DBBBF19D4F267E5CD892A7FC744D6A2E56112 \nWindows8-RT-KB4519974-x64.msu| FAF06EF46F9B0349BBD042578A023254EBC14363| 9732C27C5964486D059BE606A11A7AD05B2E55138DBB957EF9DC41E100B71FEE \nIE11-Windows6.1-KB4519974-X86.msu| 245B6DFE9D734DDD74ACCD00274E0A3EC0C03325| C667B981BE428F5995689C264E8E05FF0B51289FF22D1A523BCC8D5559EF7F44 \nIE11-Windows6.1-KB4519974-X64.msu| 16B3ED0B7EB90A3411B47F0CC610BE7C9723CCCE| 2FC798C22CD1BA1F0EFF3C40D25583EB711D6A1A74BD80E4924B0C292E4C4E37 \nIE9-Windows6.0-KB4519974-X86.msu| 8068FE103DC98312E086BBEB561D7B927A49CAB0| F4002696A847451515CF57378C095FF2434052C7F3A1324D31D7ED34EB601EE3 \nIE9-Windows6.0-KB4519974-X64.msu| 46076D619B21A10AB31199FD5422B11C2C2757DC| 886947E2377A280474DB0EFB765D6497999759E0AC779CCE16547E5084750EE6 \n**Internet Explorer 11**\n\n## Internet Explorer 11 on all supported x86-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform**| **SP requirement**| **Service branch** \n---|---|---|---|---|---|---|--- \nActxprxy.dll| 6.3.9600.19301| 1,049,600| 26-Feb-2019| 06:20| x86| None| Not applicable \nHlink.dll| 6.3.9600.19101| 99,328| 19-Jul-2018| 03:55| x86| None| Not applicable \nPngfilt.dll| 11.0.9600.17416| 57,344| 31-Oct-2014| 03:26| x86| None| Not applicable \nUrlmon.dll| 11.0.9600.19502| 1,331,712| 28-Sep-2019| 05:14| x86| None| Not applicable \nIexplore.exe| 11.0.9600.19036| 817,296| 25-May-2018| 05:24| x86| None| Not applicable \nWininetplugin.dll| 6.3.9600.17416| 35,328| 31-Oct-2014| 03:12| x86| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 46,592| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 56,320| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 57,856| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 19:17| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 47,616| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,152| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 55,296| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 45,056| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 39,424| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 35,840| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,760| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 20:29| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 20:29| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 20:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nHtml.iec| 2019.0.0.18895| 341,504| 02-Jan-2018| 04:51| Not applicable| None| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,058,752| 28-Sep-2019| 05:36| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 307,200| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,888| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,304| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,008| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 303,104| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 03:58| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 283,648| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 291,840| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,520| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 275,968| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,376| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 258,048| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 256,512| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 288,256| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 285,184| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 297,472| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 07:48| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,208| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 281,600| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,720| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,352| 10-Jul-2019| 04:42| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 242,176| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,728| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 08:35| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 78,848| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 02:47| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,752| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 62,464| 16-Aug-2014| 08:32| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 75,264| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 08:29| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,216| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 41,472| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 37,888| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 70,656| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,632| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 08:39| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.19502| 68,096| 28-Sep-2019| 07:53| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 59,904| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,120| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 29,696| 16-Aug-2014| 08:39| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nJavascriptcollectionagent.dll| 11.0.9600.17416| 60,416| 31-Oct-2014| 02:57| x86| None| Not applicable \nDiagnosticshub.scriptedsandboxplugin.dll| 11.0.9600.17905| 230,400| 15-Jun-2015| 20:50| x86| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 46,080| 11-Jun-2016| 20:26| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,712| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 54,272| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 18:10| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 45,056| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:13| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,936| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,424| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,200| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:05| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nJsproxy.dll| 11.0.9600.17416| 47,104| 31-Oct-2014| 03:16| x86| None| Not applicable \nWininet.dll| 11.0.9600.19502| 4,387,840| 28-Sep-2019| 05:18| x86| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,176| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 21:09| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 124,928| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,880| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,048| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 138,240| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,688| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18666| 114,688| 16-Apr-2017| 08:51| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 131,584| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 117,760| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,368| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 134,144| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 107,008| 07-Sep-2017| 21:13| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 123,392| 14-Oct-2017| 08:46| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 127,488| 07-Sep-2017| 21:11| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,512| 07-Sep-2017| 21:11| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 88,064| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 82,944| 14-Oct-2017| 08:47| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,392| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 120,320| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,952| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,000| 07-Sep-2017| 22:25| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:25| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 121,856| 07-Sep-2017| 20:56| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 115,712| 07-Sep-2017| 21:03| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 74,752| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 21:09| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nIeui.dll| 11.0.9600.18895| 476,160| 02-Jan-2018| 04:44| x86| None| Not applicable \nIedkcs32.dll| 18.0.9600.19404| 333,312| 10-Jul-2019| 02:38| x86| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:46| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.9301.0| 616,104| 24-Sep-2013| 02:20| Not applicable| None| Not applicable \nIeapfltr.dll| 11.0.9600.19502| 710,144| 28-Sep-2019| 05:13| x86| None| Not applicable \nIepeers.dll| 11.0.9600.19502| 128,000| 28-Sep-2019| 05:45| x86| None| Not applicable \nLicmgr10.dll| 11.0.9600.17416| 27,136| 31-Oct-2014| 03:03| x86| None| Not applicable \nTdc.ocx| 11.0.9600.18666| 73,216| 16-Apr-2017| 07:29| x86| None| Not applicable \nDiagnosticshub.datawarehouse.dll| 11.0.9600.18895| 489,472| 02-Jan-2018| 04:55| x86| None| Not applicable \nIedvtool.dll| 11.0.9600.19502| 772,608| 28-Sep-2019| 06:30| x86| None| Not applicable \nDiagnosticshub_is.dll| 11.0.9600.17416| 37,888| 31-Oct-2014| 03:29| x86| None| Not applicable \nDxtmsft.dll| 11.0.9600.18895| 416,256| 02-Jan-2018| 04:34| x86| None| Not applicable \nDxtrans.dll| 11.0.9600.19502| 279,040| 28-Sep-2019| 05:44| x86| None| Not applicable \nMicrosoft-windows-ie-f12-provider.ptxml| Not applicable| 11,892| 15-Aug-2014| 22:51| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:35| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:36| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:33| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 02:47| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:32| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:32| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:29| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:29| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:31| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:30| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:37| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:37| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.19502| 4,096| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:37| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:39| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:37| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 08:37| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 08:38| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 08:32| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 08:34| Not applicable| None| Not applicable \nDiagnosticstap.dll| 11.0.9600.17905| 174,592| 15-Jun-2015| 20:52| x86| None| Not applicable \nF12resources.dll| 11.0.9600.18939| 10,948,096| 10-Feb-2018| 17:17| x86| None| Not applicable \nF12tools.dll| 11.0.9600.17905| 255,488| 15-Jun-2015| 20:51| x86| None| Not applicable \nF12.dll| 11.0.9600.19502| 1,206,272| 28-Sep-2019| 05:42| x86| None| Not applicable \nMsfeeds.dll| 11.0.9600.19502| 696,320| 28-Sep-2019| 05:36| x86| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 06-Feb-2014| 05:53| Not applicable| None| Not applicable \nMsfeedsbs.dll| 11.0.9600.17416| 52,736| 31-Oct-2014| 02:53| x86| None| Not applicable \nMsfeedsbs.mof| Not applicable| 1,574| 21-Aug-2013| 23:49| Not applicable| None| Not applicable \nMsfeedssync.exe| 11.0.9600.17416| 11,264| 31-Oct-2014| 03:25| x86| None| Not applicable \nMshta.exe| 11.0.9600.17416| 12,800| 31-Oct-2014| 03:28| x86| None| Not applicable \nMshtmled.dll| 11.0.9600.19404| 76,288| 10-Jul-2019| 02:48| x86| None| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 06-Feb-2014| 05:40| Not applicable| None| Not applicable \nMshtml.dll| 11.0.9600.19502| 20,290,048| 28-Sep-2019| 06:30| x86| None| Not applicable \nMshtml.tlb| 11.0.9600.16518| 2,724,864| 06-Feb-2014| 10:20| Not applicable| None| Not applicable \nIeadvpack.dll| 11.0.9600.17416| 112,128| 31-Oct-2014| 03:14| x86| None| Not applicable \nIeetwcollector.exe| 11.0.9600.18666| 104,960| 16-Apr-2017| 07:47| x86| None| Not applicable \nIeetwcollectorres.dll| 11.0.9600.16518| 4,096| 06-Feb-2014| 10:19| x86| None| Not applicable \nIeetwproxystub.dll| 11.0.9600.17416| 47,616| 31-Oct-2014| 03:23| x86| None| Not applicable \nIelowutil.exe| 11.0.9600.19404| 221,184| 10-Jul-2019| 03:06| x86| None| Not applicable \nIeproxy.dll| 11.0.9600.19502| 301,056| 28-Sep-2019| 05:10| x86| None| Not applicable \nIeshims.dll| 11.0.9600.19502| 290,304| 28-Sep-2019| 05:16| x86| None| Not applicable \nIexpress.exe| 11.0.9600.17416| 152,064| 31-Oct-2014| 03:27| x86| None| Not applicable \nWextract.exe| 11.0.9600.17416| 137,728| 31-Oct-2014| 03:28| x86| None| Not applicable \nImgutil.dll| 11.0.9600.17416| 40,448| 31-Oct-2014| 02:24| x86| None| Not applicable \nExtexport.exe| 11.0.9600.17416| 25,600| 31-Oct-2014| 03:20| x86| None| Not applicable \nBing.ico| Not applicable| 5,430| 24-Sep-2013| 02:36| Not applicable| None| Not applicable \nIeunatt.exe| 11.0.9600.17416| 115,712| 31-Oct-2014| 03:12| x86| None| Not applicable \nMicrosoft-windows-ie-internetexplorer-ppdlic.xrm-ms| Not applicable| 2,956| 28-Sep-2019| 07:08| Not applicable| None| Not applicable \nWindows feed discovered.wav| Not applicable| 19,884| 24-Sep-2013| 02:58| Not applicable| None| Not applicable \nWindows information bar.wav| Not applicable| 23,308| 24-Sep-2013| 02:58| Not applicable| None| Not applicable \nWindows navigation start.wav| Not applicable| 11,340| 24-Sep-2013| 02:58| Not applicable| None| Not applicable \nWindows pop-up blocked.wav| Not applicable| 85,548| 24-Sep-2013| 02:58| Not applicable| None| Not applicable \nJsdbgui.dll| 11.0.9600.18895| 459,776| 02-Jan-2018| 04:27| x86| None| Not applicable \nJsprofilerui.dll| 11.0.9600.18895| 579,584| 02-Jan-2018| 04:27| x86| SPR| X86_MICROSOFT-WINDOWS-IE-JSP \nMemoryanalyzer.dll| 11.0.9600.19178| 1,399,296| 12-Oct-2018| 20:16| x86| None| Not applicable \nMshtmldac.dll| 11.0.9600.19502| 64,000| 28-Sep-2019| 06:10| x86| None| Not applicable \nNetworkinspection.dll| 11.0.9600.19404| 1,075,200| 10-Jul-2019| 02:45| x86| SPE| X86_MICROSOFT-WINDOWS-IE-NETWORKINSP \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 12:18| Not applicable| None| Not applicable \nOccache.dll| 11.0.9600.17416| 130,048| 31-Oct-2014| 02:48| x86| None| Not applicable \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 12:19| Not applicable| None| Not applicable \nWebcheck.dll| 11.0.9600.19502| 230,400| 28-Sep-2019| 05:38| x86| None| Not applicable \nMsdbg2.dll| 12.0.41202.0| 315,008| 30-Sep-2014| 23:00| x86| None| Not applicable \nPdm.dll| 12.0.41202.0| 442,992| 30-Sep-2014| 23:00| x86| None| Not applicable \nPdmproxy100.dll| 12.0.41202.0| 99,984| 30-Sep-2014| 23:00| x86| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 24-Sep-2013| 02:25| Not applicable| None| Not applicable \nMsrating.dll| 11.0.9600.19502| 168,960| 28-Sep-2019| 05:46| x86| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 24-Sep-2013| 02:26| Not applicable| None| Not applicable \nIertutil.dll| 11.0.9600.19502| 2,302,464| 28-Sep-2019| 06:09| x86| None| Not applicable \nIe4uinit.exe| 11.0.9600.19502| 692,224| 28-Sep-2019| 05:36| x86| None| Not applicable \nIernonce.dll| 11.0.9600.17416| 30,720| 31-Oct-2014| 03:15| x86| None| Not applicable \nIesetup.dll| 11.0.9600.17416| 62,464| 31-Oct-2014| 03:24| x86| None| Not applicable \nInseng.dll| 11.0.9600.17416| 91,136| 31-Oct-2014| 02:56| x86| None| Not applicable \nIesysprep.dll| 11.0.9600.17416| 90,624| 31-Oct-2014| 02:56| x86| SPR| X86_MICROSOFT-WINDOWS-IE-SYSP \nTimeline.dll| 11.0.9600.17416| 153,600| 31-Oct-2014| 02:55| x86| None| Not applicable \nTimeline.cpu.xml| Not applicable| 3,197| 24-Jul-2014| 19:11| Not applicable| None| Not applicable \nTimeline_is.dll| 11.0.9600.17416| 124,416| 31-Oct-2014| 03:15| x86| None| Not applicable \nVgx.dll| 11.0.9600.19502| 817,664| 28-Sep-2019| 05:46| x86| None| Not applicable \nUrl.dll| 11.0.9600.17416| 235,520| 31-Oct-2014| 03:24| x86| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,673,728| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,728,000| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,432| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,670,656| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,921,536| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,997,312| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,640,960| 28-Sep-2019| 07:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,639,936| 10-Jul-2019| 03:59| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,880| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,863,168| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,668,608| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,800| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,627,136| 28-Sep-2019| 07:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,678,336| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,690,112| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,368| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 28-Sep-2019| 07:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,761,280| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,899,008| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,890,816| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,658,880| 10-Jul-2019| 04:56| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 28-Sep-2019| 07:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,700,352| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,944| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,906,176| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,701,888| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,924,096| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,912,320| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 28-Sep-2019| 07:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,667,072| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,922,560| 28-Sep-2019| 07:41| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,288| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,705,472| 28-Sep-2019| 07:41| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeframe.dll| 11.0.9600.19502| 13,808,128| 28-Sep-2019| 05:33| x86| None| Not applicable \nIeframe.ptxml| Not applicable| 24,486| 06-Feb-2014| 05:40| Not applicable| None| Not applicable \nIeinstal.exe| 11.0.9600.18921| 475,648| 10-Feb-2018| 05:35| x86| None| Not applicable \nInetres.adml| Not applicable| 520,916| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 494,286| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 546,719| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 935,931| 28-Sep-2019| 07:48| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 452,656| 28-Sep-2019| 06:57| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 538,482| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,946| 28-Sep-2019| 07:49| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 570,169| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 564,915| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 542,763| 28-Sep-2019| 07:53| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 632,836| 28-Sep-2019| 07:50| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,065| 28-Sep-2019| 07:54| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 483,289| 28-Sep-2019| 07:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 543,188| 28-Sep-2019| 07:53| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 553,376| 28-Sep-2019| 07:53| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 529,666| 28-Sep-2019| 07:49| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 536,163| 28-Sep-2019| 07:49| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 796,921| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 498,717| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 516,048| 28-Sep-2019| 07:40| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 415,256| 28-Sep-2019| 07:40| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetres.admx| Not applicable| 1,672,213| 28-Sep-2019| 03:30| Not applicable| None| Not applicable \nInetcomm.dll| 6.3.9600.19502| 880,640| 28-Sep-2019| 05:41| x86| None| Not applicable \nInetres.dll| 6.3.9600.16384| 84,480| 22-Aug-2013| 04:14| x86| None| Not applicable \nJscript9.dll| 11.0.9600.19502| 4,112,384| 28-Sep-2019| 05:39| x86| None| Not applicable \nJscript9diag.dll| 11.0.9600.19101| 620,032| 19-Jul-2018| 03:54| x86| None| Not applicable \nJscript.dll| 5.8.9600.19502| 659,968| 28-Sep-2019| 06:02| x86| None| Not applicable \nVbscript.dll| 5.8.9600.19502| 496,128| 28-Sep-2019| 06:12| x86| None| Not applicable \n \n## Internet Explorer 11 on all supported ARM-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform**| **SP requirement**| **Service branch** \n---|---|---|---|---|---|---|--- \nActxprxy.dll| 6.3.9600.19301| 1,064,960| 26-Feb-2019| 05:59| Not applicable| None| Not applicable \nHlink.dll| 6.3.9600.19101| 68,608| 19-Jul-2018| 03:30| Not applicable| None| Not applicable \nPngfilt.dll| 11.0.9600.16384| 47,616| 22-Aug-2013| 03:06| Not applicable| None| Not applicable \nUrlmon.dll| 11.0.9600.19502| 1,037,824| 28-Sep-2019| 04:54| Not applicable| None| Not applicable \nIexplore.exe| 11.0.9600.19502| 807,816| 28-Sep-2019| 06:22| Not applicable| None| Not applicable \nWininetplugin.dll| 6.3.9600.16384| 33,792| 22-Aug-2013| 02:52| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 46,592| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 56,320| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 57,856| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 18:19| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 47,616| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,152| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 55,296| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 45,056| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 39,424| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 35,840| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:10| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,760| 12-Nov-2016| 21:09| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:07| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:07| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:06| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:06| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:06| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:06| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:08| Not applicable| None| Not applicable \nHtml.iec| 2019.0.0.19301| 320,000| 26-Feb-2019| 06:35| Not applicable| None| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,007,040| 28-Sep-2019| 05:13| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 307,200| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,888| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,304| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,008| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 303,104| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 282,112| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 282,112| 28-Sep-2019| 06:10| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 283,648| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 291,840| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,520| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 275,968| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,376| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 258,048| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 256,512| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,256| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 285,184| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 297,472| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,208| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 281,600| 28-Sep-2019| 06:48| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,720| 28-Sep-2019| 06:48| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,352| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 242,176| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,728| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 78,848| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 01:39| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,752| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 62,464| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 75,264| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 11:28| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,216| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 41,472| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 37,888| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 70,656| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,632| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.19502| 68,096| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 59,904| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,120| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 29,696| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nJavascriptcollectionagent.dll| 11.0.9600.17416| 63,488| 31-Oct-2014| 02:29| Not applicable| None| Not applicable \nDiagnosticshub.scriptedsandboxplugin.dll| 11.0.9600.17905| 215,552| 15-Jun-2015| 19:49| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 46,080| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,712| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 54,272| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 17:09| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 45,056| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 19:54| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,936| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,424| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,200| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 19:53| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:59| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:58| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:58| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 19:58| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:02| Not applicable| None| Not applicable \nJsproxy.dll| 11.0.9600.17416| 39,936| 31-Oct-2014| 02:43| Not applicable| None| Not applicable \nWininet.dll| 11.0.9600.19502| 4,147,712| 28-Sep-2019| 04:54| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,176| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 124,928| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,880| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,048| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 138,240| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,688| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18698| 114,688| 14-May-2017| 19:41| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 131,584| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 117,760| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,368| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 134,144| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 107,008| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 123,392| 14-Oct-2017| 07:14| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 127,488| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,512| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 88,064| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 82,944| 14-Oct-2017| 07:14| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,392| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 120,320| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,952| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,000| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 121,856| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 115,712| 07-Sep-2017| 22:21| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:21| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 22:22| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 74,752| 07-Sep-2017| 22:21| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 22:23| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 22:24| Not applicable| None| Not applicable \nIeui.dll| 11.0.9600.19101| 427,520| 19-Jul-2018| 03:30| Not applicable| None| Not applicable \nIedkcs32.dll| 18.0.9600.19502| 292,864| 28-Sep-2019| 05:14| Not applicable| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:41| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.9301.0| 616,104| 24-Sep-2013| 02:22| Not applicable| None| Not applicable \nIeapfltr.dll| 11.0.9600.19502| 548,352| 28-Sep-2019| 04:57| Not applicable| None| Not applicable \nIepeers.dll| 11.0.9600.19502| 107,008| 28-Sep-2019| 05:21| Not applicable| None| Not applicable \nLicmgr10.dll| 11.0.9600.17416| 23,552| 31-Oct-2014| 02:34| Not applicable| None| Not applicable \nTdc.ocx| 11.0.9600.18698| 61,952| 14-May-2017| 18:43| Not applicable| None| Not applicable \nDiagnosticshub.datawarehouse.dll| 11.0.9600.17416| 495,616| 31-Oct-2014| 02:52| Not applicable| None| Not applicable \nIedvtool.dll| 11.0.9600.19502| 726,016| 28-Sep-2019| 05:23| Not applicable| None| Not applicable \nDiagnosticshub_is.dll| 11.0.9600.17416| 38,912| 31-Oct-2014| 02:53| Not applicable| None| Not applicable \nDxtmsft.dll| 11.0.9600.18052| 368,640| 10-Sep-2015| 15:57| Not applicable| None| Not applicable \nDxtrans.dll| 11.0.9600.19502| 221,696| 28-Sep-2019| 05:20| Not applicable| None| Not applicable \nMicrosoft-windows-ie-f12-provider.ptxml| Not applicable| 11,892| 15-Aug-2014| 22:50| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:20| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 01:39| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:28| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:17| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.19502| 4,096| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:26| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:27| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:18| Not applicable| None| Not applicable \nDiagnosticstap.dll| 11.0.9600.19180| 174,592| 18-Oct-2018| 03:55| Not applicable| None| Not applicable \nF12resources.dll| 11.0.9600.17496| 10,948,608| 22-Nov-2014| 01:44| Not applicable| None| Not applicable \nF12tools.dll| 11.0.9600.19502| 263,168| 28-Sep-2019| 05:27| Not applicable| None| Not applicable \nF12.dll| 11.0.9600.19502| 1,184,256| 28-Sep-2019| 05:19| Not applicable| None| Not applicable \nMsfeeds.dll| 11.0.9600.19502| 587,264| 28-Sep-2019| 05:13| Not applicable| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 06-Feb-2014| 05:51| Not applicable| None| Not applicable \nMsfeedsbs.dll| 11.0.9600.17416| 43,008| 31-Oct-2014| 02:26| Not applicable| None| Not applicable \nMsfeedsbs.mof| Not applicable| 1,574| 21-Aug-2013| 23:43| Not applicable| None| Not applicable \nMsfeedssync.exe| 11.0.9600.16384| 11,776| 22-Aug-2013| 03:05| Not applicable| None| Not applicable \nMshtmled.dll| 11.0.9600.19502| 73,216| 28-Sep-2019| 05:22| Not applicable| None| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 06-Feb-2014| 05:39| Not applicable| None| Not applicable \nMshtml.dll| 11.0.9600.19502| 16,227,840| 28-Sep-2019| 05:07| Not applicable| None| Not applicable \nMshtml.tlb| 11.0.9600.16518| 2,724,864| 06-Feb-2014| 09:36| Not applicable| None| Not applicable \nIeadvpack.dll| 11.0.9600.16384| 98,816| 22-Aug-2013| 02:54| Not applicable| None| Not applicable \nIeetwcollector.exe| 11.0.9600.18658| 98,816| 05-Apr-2017| 17:29| Not applicable| None| Not applicable \nIeetwcollectorres.dll| 11.0.9600.16518| 4,096| 06-Feb-2014| 09:36| Not applicable| None| Not applicable \nIeetwproxystub.dll| 11.0.9600.16518| 43,008| 06-Feb-2014| 09:23| Not applicable| None| Not applicable \nIelowutil.exe| 11.0.9600.17031| 222,208| 22-Feb-2014| 09:32| Not applicable| None| Not applicable \nIeproxy.dll| 11.0.9600.19502| 297,472| 28-Sep-2019| 04:55| Not applicable| None| Not applicable \nIeshims.dll| 11.0.9600.19502| 268,800| 28-Sep-2019| 05:00| Not applicable| None| Not applicable \nImgutil.dll| 11.0.9600.18123| 35,328| 08-Nov-2015| 20:20| Not applicable| None| Not applicable \nBing.ico| Not applicable| 5,430| 24-Sep-2013| 02:51| Not applicable| None| Not applicable \nIeunatt.exe| 11.0.9600.16518| 112,128| 06-Feb-2014| 09:12| Not applicable| None| Not applicable \nMicrosoft-windows-ie-internetexplorer-ppdlic.xrm-ms| Not applicable| 2,956| 28-Sep-2019| 06:17| Not applicable| None| Not applicable \nWindows feed discovered.wav| Not applicable| 19,884| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows information bar.wav| Not applicable| 23,308| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows navigation start.wav| Not applicable| 11,340| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows pop-up blocked.wav| Not applicable| 85,548| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nJsdbgui.dll| 11.0.9600.17905| 457,216| 15-Jun-2015| 19:46| Not applicable| None| Not applicable \nJsprofilerui.dll| 11.0.9600.19502| 574,976| 28-Sep-2019| 05:23| Not applicable| SPR| ARM_MICROSOFT-WINDOWS-IE-JSP \nMemoryanalyzer.dll| 11.0.9600.17905| 1,934,848| 15-Jun-2015| 20:00| Not applicable| None| Not applicable \nMshtmldac.dll| 11.0.9600.19502| 60,928| 28-Sep-2019| 05:40| Not applicable| None| Not applicable \nNetworkinspection.dll| 11.0.9600.19400| 1,105,408| 18-Jun-2019| 02:49| Not applicable| SPE| ARM_MICROSOFT-WINDOWS-IE-NETWORKINSP \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 14:46| Not applicable| None| Not applicable \nOccache.dll| 11.0.9600.19502| 121,856| 28-Sep-2019| 05:20| Not applicable| None| Not applicable \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 14:46| Not applicable| None| Not applicable \nWebcheck.dll| 11.0.9600.19502| 201,216| 28-Sep-2019| 05:15| Not applicable| None| Not applicable \nMsdbg2.dll| 12.0.20712.1| 295,320| 26-Jul-2013| 17:03| Not applicable| None| Not applicable \nPdm.dll| 12.0.20712.1| 420,752| 26-Jul-2013| 17:03| Not applicable| None| Not applicable \nPdmproxy100.dll| 12.0.20712.1| 76,712| 26-Jul-2013| 17:03| Not applicable| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 24-Sep-2013| 02:32| Not applicable| None| Not applicable \nMsrating.dll| 11.0.9600.17905| 157,184| 15-Jun-2015| 19:46| Not applicable| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 24-Sep-2013| 02:32| Not applicable| None| Not applicable \nIertutil.dll| 11.0.9600.19502| 2,180,608| 28-Sep-2019| 05:34| Not applicable| None| Not applicable \nIe4uinit.exe| 11.0.9600.19502| 677,888| 28-Sep-2019| 05:14| Not applicable| None| Not applicable \nIernonce.dll| 11.0.9600.16518| 28,160| 06-Feb-2014| 09:15| Not applicable| None| Not applicable \nIesetup.dll| 11.0.9600.16518| 59,904| 06-Feb-2014| 09:23| Not applicable| None| Not applicable \nInseng.dll| 11.0.9600.16384| 77,312| 22-Aug-2013| 02:35| Not applicable| None| Not applicable \nIesysprep.dll| 11.0.9600.17416| 87,552| 31-Oct-2014| 02:28| Not applicable| SPR| ARM_MICROSOFT-WINDOWS-IE-SYSP \nTimeline.dll| 11.0.9600.19502| 155,136| 28-Sep-2019| 05:24| Not applicable| None| Not applicable \nTimeline.cpu.xml| Not applicable| 3,197| 24-Jul-2014| 19:09| Not applicable| None| Not applicable \nTimeline_is.dll| 11.0.9600.17416| 129,536| 31-Oct-2014| 02:43| Not applicable| None| Not applicable \nVgx.dll| 11.0.9600.19502| 734,208| 28-Sep-2019| 05:22| Not applicable| None| Not applicable \nUrl.dll| 11.0.9600.17416| 236,032| 31-Oct-2014| 02:49| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,673,728| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,728,000| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,670,656| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,536| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,997,312| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,640,960| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,639,936| 28-Sep-2019| 06:11| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,880| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,863,168| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,668,608| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,932,800| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,627,136| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,678,336| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,690,112| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,368| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,761,280| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,899,008| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,890,816| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,658,880| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,700,352| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,944| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,906,176| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,888| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,924,096| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,912,320| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,667,072| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,922,560| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,932,288| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,705,472| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,497,600| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,497,600| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nIeframe.dll| 11.0.9600.19502| 12,251,136| 28-Sep-2019| 04:56| Not applicable| None| Not applicable \nIeframe.ptxml| Not applicable| 24,486| 06-Feb-2014| 05:38| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,916| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 494,286| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 546,719| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 935,931| 28-Sep-2019| 06:53| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 452,656| 28-Sep-2019| 06:11| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 538,482| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,946| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 570,169| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 564,915| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 542,763| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 632,836| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,065| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 483,289| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 543,188| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 553,376| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 529,666| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 536,163| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 796,921| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 498,717| 28-Sep-2019| 06:50| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 516,048| 28-Sep-2019| 06:49| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 415,256| 28-Sep-2019| 06:48| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 06:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 06:51| Not applicable| None| Not applicable \nInetres.admx| Not applicable| 1,672,213| 28-Sep-2019| 03:29| Not applicable| None| Not applicable \nInetcomm.dll| 6.3.9600.19502| 675,328| 28-Sep-2019| 05:16| Not applicable| None| Not applicable \nInetres.dll| 6.3.9600.16384| 84,480| 22-Aug-2013| 03:15| Not applicable| None| Not applicable \nJscript9.dll| 11.0.9600.19502| 3,572,224| 28-Sep-2019| 05:05| Not applicable| None| Not applicable \nJscript9diag.dll| 11.0.9600.19502| 557,568| 28-Sep-2019| 05:35| Not applicable| None| Not applicable \nJscript.dll| 5.8.9600.19502| 518,144| 28-Sep-2019| 05:34| Not applicable| None| Not applicable \nVbscript.dll| 5.8.9600.19502| 402,944| 28-Sep-2019| 05:39| Not applicable| None| Not applicable \n \n## Internet Explorer 11 on all supported x64-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform**| **SP requirement**| **Service branch** \n---|---|---|---|---|---|---|--- \nActxprxy.dll| 6.3.9600.19301| 2,882,048| 26-Feb-2019| 06:25| x64| None| Not applicable \nHlink.dll| 6.3.9600.19101| 108,544| 19-Jul-2018| 04:22| x64| None| Not applicable \nPngfilt.dll| 11.0.9600.17416| 64,512| 31-Oct-2014| 05:09| x64| None| Not applicable \nUrlmon.dll| 11.0.9600.19502| 1,566,208| 28-Sep-2019| 05:31| x64| None| Not applicable \nIexplore.exe| 11.0.9600.19036| 817,296| 25-May-2018| 06:30| x64| None| Not applicable \nWininetplugin.dll| 6.3.9600.17416| 43,008| 31-Oct-2014| 04:51| x64| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 46,592| 12-Nov-2016| 21:35| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 56,320| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 57,856| 13-Nov-2016| 00:01| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 23:59| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 20:20| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 13-Nov-2016| 00:00| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 47,616| 12-Nov-2016| 23:59| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,152| 12-Nov-2016| 23:58| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 55,296| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 45,056| 13-Nov-2016| 00:02| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 23:57| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 23:57| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 39,424| 12-Nov-2016| 21:39| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 35,840| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:39| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,760| 12-Nov-2016| 21:39| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:39| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:38| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:37| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:37| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:37| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:34| Not applicable| None| Not applicable \nHtml.iec| 2019.0.0.19301| 417,280| 26-Feb-2019| 07:31| Not applicable| None| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,132,992| 28-Sep-2019| 05:54| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 307,200| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,888| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,304| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 05:17| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,008| 10-Jul-2019| 05:18| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 303,104| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 04:33| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 283,648| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 291,840| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,520| 10-Jul-2019| 05:18| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 275,968| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,376| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 07:26| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 258,048| 10-Jul-2019| 07:26| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 256,512| 10-Jul-2019| 07:25| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 07:25| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 288,256| 10-Jul-2019| 07:25| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 285,184| 10-Jul-2019| 07:25| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 07:26| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 297,472| 10-Jul-2019| 07:25| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 05:12| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,208| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 281,600| 10-Jul-2019| 05:06| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,720| 10-Jul-2019| 05:04| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,352| 10-Jul-2019| 05:04| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 242,176| 10-Jul-2019| 05:04| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 05:17| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,728| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 12:00| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 78,848| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 61,440| 16-Aug-2014| 03:19| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,752| 16-Aug-2014| 12:00| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 62,464| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 12:04| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 75,264| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 73,216| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 41,472| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 37,888| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 67,584| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 74,240| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 70,656| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,680| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 71,168| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,632| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 68,608| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.19502| 68,096| 28-Sep-2019| 08:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 59,904| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 65,536| 16-Aug-2014| 12:04| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 69,120| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 29,696| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12resources.dll.mui| 11.0.9600.17278| 30,720| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nJavascriptcollectionagent.dll| 11.0.9600.17416| 77,824| 31-Oct-2014| 04:30| x64| None| Not applicable \nDiagnosticshub.scriptedsandboxplugin.dll| 11.0.9600.18895| 276,480| 02-Jan-2018| 05:02| x64| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 46,080| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,712| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 54,272| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:08| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 45,056| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,936| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,424| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,200| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 20:19| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 28-Sep-2019| 08:57| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 20:14| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 20:15| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 20:15| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:15| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:20| Not applicable| None| Not applicable \nJsproxy.dll| 11.0.9600.17416| 54,784| 31-Oct-2014| 04:57| x64| None| Not applicable \nWininet.dll| 11.0.9600.19502| 4,859,904| 28-Sep-2019| 05:42| x64| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,176| 08-Sep-2017| 00:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 08-Sep-2017| 00:16| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 124,928| 08-Sep-2017| 00:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,880| 08-Sep-2017| 00:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,048| 08-Sep-2017| 00:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 138,240| 08-Sep-2017| 00:39| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,688| 08-Sep-2017| 00:38| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18666| 114,688| 16-Apr-2017| 09:49| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 131,584| 08-Sep-2017| 00:38| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 117,760| 08-Sep-2017| 00:39| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,368| 08-Sep-2017| 00:40| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 134,144| 08-Sep-2017| 00:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 107,008| 08-Sep-2017| 00:40| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 123,392| 14-Oct-2017| 09:53| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 127,488| 08-Sep-2017| 00:36| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,512| 08-Sep-2017| 00:21| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 88,064| 08-Sep-2017| 00:19| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 82,944| 14-Oct-2017| 09:53| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 08-Sep-2017| 00:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,392| 08-Sep-2017| 00:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 120,320| 08-Sep-2017| 00:21| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 08-Sep-2017| 00:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 08-Sep-2017| 00:19| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,952| 07-Sep-2017| 23:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 23:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,000| 07-Sep-2017| 23:16| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 23:17| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 23:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 23:16| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 121,856| 07-Sep-2017| 23:18| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 115,712| 07-Sep-2017| 23:13| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 23:14| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 23:13| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 74,752| 07-Sep-2017| 23:13| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 08-Sep-2017| 00:16| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 08-Sep-2017| 00:17| Not applicable| None| Not applicable \nIeui.dll| 11.0.9600.19463| 615,936| 27-Aug-2019| 03:17| x64| None| Not applicable \nIedkcs32.dll| 18.0.9600.19502| 381,952| 28-Sep-2019| 05:57| x64| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:44| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.9301.0| 616,104| 24-Sep-2013| 02:22| Not applicable| None| Not applicable \nIeapfltr.dll| 11.0.9600.19502| 800,768| 28-Sep-2019| 05:20| x64| None| Not applicable \nIepeers.dll| 11.0.9600.19502| 145,408| 28-Sep-2019| 06:10| x64| None| Not applicable \nLicmgr10.dll| 11.0.9600.17416| 33,280| 31-Oct-2014| 04:40| x64| None| Not applicable \nTdc.ocx| 11.0.9600.18666| 87,552| 16-Apr-2017| 08:10| x64| None| Not applicable \nDiagnosticshub.datawarehouse.dll| 11.0.9600.18895| 666,624| 02-Jan-2018| 05:32| x64| None| Not applicable \nIedvtool.dll| 11.0.9600.19502| 950,784| 28-Sep-2019| 07:11| x64| None| Not applicable \nDiagnosticshub_is.dll| 11.0.9600.17416| 49,664| 31-Oct-2014| 05:13| x64| None| Not applicable \nDxtmsft.dll| 11.0.9600.18895| 489,984| 02-Jan-2018| 05:06| x64| None| Not applicable \nDxtrans.dll| 11.0.9600.19502| 315,392| 28-Sep-2019| 06:10| x64| None| Not applicable \nEscmigplugin.dll| 11.0.9600.19326| 123,904| 26-Mar-2019| 05:38| x64| None| Not applicable \nEscunattend.exe| 11.0.9600.19326| 87,040| 26-Mar-2019| 05:54| x64| None| Not applicable \nMicrosoft-windows-ie-f12-provider.ptxml| Not applicable| 11,892| 15-Aug-2014| 22:51| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:00| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 03:19| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:59| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:04| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:02| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:04| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:01| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:04| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.19502| 4,096| 28-Sep-2019| 08:58| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 4,096| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 12:03| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nF12.dll.mui| 11.0.9600.17278| 3,584| 16-Aug-2014| 11:58| Not applicable| None| Not applicable \nDiagnosticstap.dll| 11.0.9600.18895| 244,224| 02-Jan-2018| 05:04| x64| None| Not applicable \nF12resources.dll| 11.0.9600.17496| 10,949,120| 22-Nov-2014| 03:00| x64| None| Not applicable \nF12tools.dll| 11.0.9600.19502| 372,224| 28-Sep-2019| 06:20| x64| None| Not applicable \nF12.dll| 11.0.9600.19502| 1,421,312| 28-Sep-2019| 06:06| x64| None| Not applicable \nMsfeeds.dll| 11.0.9600.19502| 809,472| 28-Sep-2019| 05:57| x64| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 06-Feb-2014| 05:54| Not applicable| None| Not applicable \nMsfeedsbs.dll| 11.0.9600.17416| 60,416| 31-Oct-2014| 04:24| x64| None| Not applicable \nMsfeedsbs.mof| Not applicable| 1,574| 22-Aug-2013| 06:54| Not applicable| None| Not applicable \nMsfeedssync.exe| 11.0.9600.17416| 12,800| 31-Oct-2014| 05:08| x64| None| Not applicable \nMshta.exe| 11.0.9600.17416| 13,824| 31-Oct-2014| 05:12| x64| None| Not applicable \nMshtmled.dll| 11.0.9600.19502| 92,160| 28-Sep-2019| 06:12| x64| None| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 06-Feb-2014| 05:41| Not applicable| None| Not applicable \nMshtml.dll| 11.0.9600.19502| 25,752,576| 28-Sep-2019| 07:11| x64| None| Not applicable \nMshtml.tlb| 11.0.9600.16518| 2,724,864| 06-Feb-2014| 11:30| Not applicable| None| Not applicable \nIeadvpack.dll| 11.0.9600.17416| 132,096| 31-Oct-2014| 04:54| x64| None| Not applicable \nIeetwcollector.exe| 11.0.9600.18895| 116,224| 02-Jan-2018| 05:17| x64| None| Not applicable \nIeetwcollectorres.dll| 11.0.9600.16518| 4,096| 06-Feb-2014| 11:30| x64| None| Not applicable \nIeetwproxystub.dll| 11.0.9600.18895| 48,640| 02-Jan-2018| 05:28| x64| None| Not applicable \nIelowutil.exe| 11.0.9600.17416| 222,720| 31-Oct-2014| 04:55| x64| None| Not applicable \nIeproxy.dll| 11.0.9600.19502| 805,376| 28-Sep-2019| 05:16| x64| None| Not applicable \nIeshims.dll| 11.0.9600.19404| 386,560| 10-Jul-2019| 02:24| x64| None| Not applicable \nIexpress.exe| 11.0.9600.17416| 167,424| 31-Oct-2014| 05:10| x64| None| Not applicable \nWextract.exe| 11.0.9600.17416| 143,872| 31-Oct-2014| 05:12| x64| None| Not applicable \nImgutil.dll| 11.0.9600.17416| 51,200| 31-Oct-2014| 03:42| x64| None| Not applicable \nBing.ico| Not applicable| 5,430| 24-Sep-2013| 02:51| Not applicable| None| Not applicable \nIeunatt.exe| 11.0.9600.17416| 144,384| 31-Oct-2014| 04:51| x64| None| Not applicable \nMicrosoft-windows-ie-internetexplorer-ppdlic.xrm-ms| Not applicable| 2,956| 28-Sep-2019| 07:59| Not applicable| None| Not applicable \nWindows feed discovered.wav| Not applicable| 19,884| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows information bar.wav| Not applicable| 23,308| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows navigation start.wav| Not applicable| 11,340| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nWindows pop-up blocked.wav| Not applicable| 85,548| 24-Sep-2013| 03:25| Not applicable| None| Not applicable \nJsdbgui.dll| 11.0.9600.19404| 591,360| 10-Jul-2019| 03:12| x64| None| Not applicable \nJsprofilerui.dll| 11.0.9600.18895| 628,736| 02-Jan-2018| 04:56| x64| SPR| AMD64_MICROSOFT-WINDOWS-IE-JSP \nMemoryanalyzer.dll| 11.0.9600.19178| 1,862,144| 12-Oct-2018| 01:58| x64| None| Not applicable \nMshtmldac.dll| 11.0.9600.19502| 88,064| 28-Sep-2019| 06:44| x64| None| Not applicable \nNetworkinspection.dll| 11.0.9600.19502| 1,217,024| 28-Sep-2019| 06:07| x64| SPE| AMD64_MICROSOFT-WINDOWS-IE-NETWORKINSP \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 14:43| Not applicable| None| Not applicable \nOccache.dll| 11.0.9600.17416| 152,064| 31-Oct-2014| 04:19| x64| None| Not applicable \nDesktop.ini| Not applicable| 65| 18-Jun-2013| 14:44| Not applicable| None| Not applicable \nWebcheck.dll| 11.0.9600.19502| 262,144| 28-Sep-2019| 05:59| x64| None| Not applicable \nMsdbg2.dll| 12.0.41202.0| 403,592| 30-Sep-2014| 23:01| x64| None| Not applicable \nPdm.dll| 12.0.41202.0| 579,192| 30-Sep-2014| 23:01| x64| None| Not applicable \nPdmproxy100.dll| 12.0.41202.0| 107,152| 30-Sep-2014| 23:01| x64| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 24-Sep-2013| 02:32| Not applicable| None| Not applicable \nMsrating.dll| 11.0.9600.18895| 199,680| 02-Jan-2018| 04:56| x64| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 24-Sep-2013| 02:32| Not applicable| None| Not applicable \nIertutil.dll| 11.0.9600.19502| 2,909,184| 28-Sep-2019| 06:47| x64| None| Not applicable \nIe4uinit.exe| 11.0.9600.19502| 728,064| 28-Sep-2019| 05:57| x64| None| Not applicable \nIernonce.dll| 11.0.9600.17416| 34,304| 31-Oct-2014| 04:56| x64| None| Not applicable \nIesetup.dll| 11.0.9600.17416| 66,560| 31-Oct-2014| 05:06| x64| None| Not applicable \nInseng.dll| 11.0.9600.19101| 107,520| 19-Jul-2018| 04:03| x64| None| Not applicable \nIesysprep.dll| 11.0.9600.17416| 111,616| 31-Oct-2014| 04:29| x64| SPR| AMD64_MICROSOFT-WINDOWS-IE-SYSP \nTimeline.dll| 11.0.9600.17905| 219,136| 15-Jun-2015| 22:01| x64| None| Not applicable \nTimeline.cpu.xml| Not applicable| 3,197| 24-Jul-2014| 18:58| Not applicable| None| Not applicable \nTimeline_is.dll| 11.0.9600.17416| 171,008| 31-Oct-2014| 04:56| x64| None| Not applicable \nVgx.dll| 11.0.9600.19502| 1,018,368| 28-Sep-2019| 06:12| x64| None| Not applicable \nUrl.dll| 11.0.9600.17416| 237,568| 31-Oct-2014| 05:06| x64| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,673,728| 10-Jul-2019| 05:20| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,728,000| 10-Jul-2019| 05:18| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,432| 10-Jul-2019| 05:20| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,670,656| 10-Jul-2019| 05:21| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,921,536| 10-Jul-2019| 05:19| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,997,312| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,640,960| 28-Sep-2019| 08:38| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,639,936| 10-Jul-2019| 04:33| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,880| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,863,168| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,668,608| 10-Jul-2019| 05:16| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,800| 10-Jul-2019| 05:20| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,627,136| 28-Sep-2019| 08:39| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,678,336| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,690,112| 10-Jul-2019| 05:15| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,368| 10-Jul-2019| 07:27| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 28-Sep-2019| 08:44| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,761,280| 10-Jul-2019| 07:27| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,899,008| 10-Jul-2019| 07:27| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,890,816| 10-Jul-2019| 07:26| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,658,880| 10-Jul-2019| 07:26| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 28-Sep-2019| 08:44| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,700,352| 10-Jul-2019| 07:27| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,944| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,906,176| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,701,888| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,924,096| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,912,320| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 05:14| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 28-Sep-2019| 09:00| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,667,072| 10-Jul-2019| 05:13| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,922,560| 28-Sep-2019| 08:42| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 05:05| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,288| 10-Jul-2019| 05:07| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,705,472| 28-Sep-2019| 08:42| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 05:21| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 05:21| Not applicable| None| Not applicable \nIeframe.dll| 11.0.9600.19502| 15,413,760| 28-Sep-2019| 05:52| x64| None| Not applicable \nIeframe.ptxml| Not applicable| 24,486| 06-Feb-2014| 05:41| Not applicable| None| Not applicable \nIeinstal.exe| 11.0.9600.18639| 492,032| 25-Mar-2017| 17:20| x64| None| Not applicable \nInetres.adml| Not applicable| 520,916| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 494,286| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 546,719| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 935,931| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 452,656| 28-Sep-2019| 07:34| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 538,482| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,946| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 570,169| 28-Sep-2019| 08:39| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 564,915| 28-Sep-2019| 08:37| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 542,763| 28-Sep-2019| 08:43| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 632,836| 28-Sep-2019| 08:43| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 520,065| 28-Sep-2019| 08:43| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 483,289| 28-Sep-2019| 08:44| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 543,188| 28-Sep-2019| 08:44| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 553,376| 28-Sep-2019| 08:43| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 529,666| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 536,163| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 796,921| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 498,717| 28-Sep-2019| 08:59| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 516,048| 28-Sep-2019| 08:41| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 415,256| 28-Sep-2019| 08:41| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 08:40| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,865| 28-Sep-2019| 08:38| Not applicable| None| Not applicable \nInetres.admx| Not applicable| 1,672,213| 28-Sep-2019| 03:30| Not applicable| None| Not applicable \nInetcomm.dll| 6.3.9600.19502| 1,033,216| 28-Sep-2019| 06:05| x64| None| Not applicable \nInetres.dll| 6.3.9600.16384| 84,480| 22-Aug-2013| 11:43| x64| None| Not applicable \nJscript9.dll| 11.0.9600.19502| 5,500,928| 28-Sep-2019| 06:33| x64| None| Not applicable \nJscript9diag.dll| 11.0.9600.19101| 814,080| 19-Jul-2018| 04:21| x64| None| Not applicable \nJscript.dll| 5.8.9600.19502| 793,088| 28-Sep-2019| 06:33| x64| None| Not applicable \nVbscript.dll| 5.8.9600.19502| 579,584| 28-Sep-2019| 06:45| x64| None| Not applicable \nIexplore.exe| 11.0.9600.19036| 817,296| 25-May-2018| 05:24| x86| None| Not applicable \nHtml.iec| 2019.0.0.18895| 341,504| 02-Jan-2018| 04:51| Not applicable| None| Not applicable \nIeui.dll| 11.0.9600.18895| 476,160| 02-Jan-2018| 04:44| x86| None| Not applicable \nIepeers.dll| 11.0.9600.19502| 128,000| 28-Sep-2019| 05:45| x86| None| Not applicable \nTdc.ocx| 11.0.9600.18666| 73,216| 16-Apr-2017| 07:29| x86| None| Not applicable \nDxtmsft.dll| 11.0.9600.18895| 416,256| 02-Jan-2018| 04:34| x86| None| Not applicable \nDxtrans.dll| 11.0.9600.19502| 279,040| 28-Sep-2019| 05:44| x86| None| Not applicable \nMsfeeds.dll| 11.0.9600.19502| 696,320| 28-Sep-2019| 05:36| x86| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 06-Feb-2014| 05:53| Not applicable| None| Not applicable \nMshta.exe| 11.0.9600.17416| 12,800| 31-Oct-2014| 03:28| x86| None| Not applicable \nMshtmled.dll| 11.0.9600.19404| 76,288| 10-Jul-2019| 02:48| x86| None| Not applicable \nMshtml.dll| 11.0.9600.19502| 20,290,048| 28-Sep-2019| 06:30| x86| None| Not applicable \nMshtml.tlb| 11.0.9600.16518| 2,724,864| 06-Feb-2014| 10:20| Not applicable| None| Not applicable \nWow64_microsoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 06-Feb-2014| 05:43| Not applicable| None| Not applicable \nIeetwproxystub.dll| 11.0.9600.17416| 47,616| 31-Oct-2014| 03:23| x86| None| Not applicable \nIeunatt.exe| 11.0.9600.17416| 115,712| 31-Oct-2014| 03:12| x86| None| Not applicable \nOccache.dll| 11.0.9600.17416| 130,048| 31-Oct-2014| 02:48| x86| None| Not applicable \nWebcheck.dll| 11.0.9600.19502| 230,400| 28-Sep-2019| 05:38| x86| None| Not applicable \nIernonce.dll| 11.0.9600.17416| 30,720| 31-Oct-2014| 03:15| x86| None| Not applicable \nIesetup.dll| 11.0.9600.17416| 62,464| 31-Oct-2014| 03:24| x86| None| Not applicable \nIesysprep.dll| 11.0.9600.17416| 90,624| 31-Oct-2014| 02:56| x86| SPR| WOW64_MICROSOFT-WINDOWS-IE-SYSP \nIe9props.propdesc| Not applicable| 2,843| 24-Sep-2013| 02:34| Not applicable| None| Not applicable \nIeframe.dll| 11.0.9600.19502| 13,808,128| 28-Sep-2019| 05:33| x86| None| Not applicable \nWow64_ieframe.ptxml| Not applicable| 24,486| 06-Feb-2014| 05:43| Not applicable| None| Not applicable \nJscript9.dll| 11.0.9600.19502| 4,112,384| 28-Sep-2019| 05:39| x86| None| Not applicable \nJscript9diag.dll| 11.0.9600.19101| 620,032| 19-Jul-2018| 03:54| x86| None| Not applicable \nJscript.dll| 5.8.9600.19502| 659,968| 28-Sep-2019| 06:02| x86| None| Not applicable \nVbscript.dll| 5.8.9600.19502| 496,128| 28-Sep-2019| 06:12| x86| None| Not applicable \nActxprxy.dll| 6.3.9600.19301| 1,049,600| 26-Feb-2019| 06:20| x86| None| Not applicable \nHlink.dll| 6.3.9600.19101| 99,328| 19-Jul-2018| 03:55| x86| None| Not applicable \nPngfilt.dll| 11.0.9600.17416| 57,344| 31-Oct-2014| 03:26| x86| None| Not applicable \nUrlmon.dll| 11.0.9600.19502| 1,331,712| 28-Sep-2019| 05:14| x86| None| Not applicable \nWininetplugin.dll| 6.3.9600.17416| 35,328| 31-Oct-2014| 03:12| x86| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 46,592| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 56,320| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 57,856| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,664| 12-Nov-2016| 19:17| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 47,616| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 49,152| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 55,296| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 45,056| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,712| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 39,424| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 35,840| 12-Nov-2016| 21:32| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,760| 12-Nov-2016| 21:31| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 54,272| 12-Nov-2016| 20:29| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 51,200| 12-Nov-2016| 20:29| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 53,248| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 52,736| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 20:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,688| 12-Nov-2016| 20:27| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 50,176| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 20:28| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nWininet.dll.mui| 11.0.9600.18538| 31,232| 12-Nov-2016| 21:30| Not applicable| None| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,058,752| 28-Sep-2019| 05:36| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 307,200| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,888| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,304| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,008| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 303,104| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 282,112| 10-Jul-2019| 03:58| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 283,648| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 291,840| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 299,520| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 275,968| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 293,376| 10-Jul-2019| 04:49| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 296,960| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 258,048| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 256,512| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 289,280| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 288,256| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 285,184| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 297,472| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 295,424| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 294,400| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,864| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 290,816| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 28-Sep-2019| 07:48| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,208| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 281,600| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 286,720| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 292,352| 10-Jul-2019| 04:42| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 242,176| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nMshtml.dll.mui| 11.0.9600.19404| 243,200| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nJavascriptcollectionagent.dll| 11.0.9600.17416| 60,416| 31-Oct-2014| 02:57| x86| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 46,080| 11-Jun-2016| 20:26| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,712| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 54,272| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 18:10| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 20:24| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 45,056| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:12| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:13| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,936| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 39,424| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 47,616| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 51,200| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,688| 11-Jun-2016| 19:07| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 50,176| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:02| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,664| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,640| 11-Jun-2016| 19:03| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 49,152| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 48,128| 11-Jun-2016| 19:05| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 19:04| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nUrlmon.dll.mui| 11.0.9600.18378| 35,328| 11-Jun-2016| 20:23| Not applicable| None| Not applicable \nJsproxy.dll| 11.0.9600.17416| 47,104| 31-Oct-2014| 03:16| x86| None| Not applicable \nWininet.dll| 11.0.9600.19502| 4,387,840| 28-Sep-2019| 05:18| x86| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,176| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 21:09| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 124,928| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,880| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,048| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 138,240| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 114,688| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18666| 114,688| 16-Apr-2017| 08:51| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 131,584| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 117,760| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 122,368| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 134,144| 07-Sep-2017| 21:12| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 107,008| 07-Sep-2017| 21:13| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 123,392| 14-Oct-2017| 08:46| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 127,488| 07-Sep-2017| 21:11| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,512| 07-Sep-2017| 21:11| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 88,064| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18838| 82,944| 14-Oct-2017| 08:47| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,392| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 120,320| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 130,560| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 21:07| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,952| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 128,000| 07-Sep-2017| 22:25| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 129,024| 07-Sep-2017| 22:26| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 22:25| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 28-Sep-2019| 07:47| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 121,856| 07-Sep-2017| 20:56| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 115,712| 07-Sep-2017| 21:03| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 123,904| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 125,440| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 74,752| 07-Sep-2017| 21:04| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 21:09| Not applicable| None| Not applicable \nInetcpl.cpl.mui| 11.0.9600.18817| 75,776| 07-Sep-2017| 21:10| Not applicable| None| Not applicable \nIedkcs32.dll| 18.0.9600.19404| 333,312| 10-Jul-2019| 02:38| x86| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:46| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.9301.0| 616,104| 24-Sep-2013| 02:20| Not applicable| None| Not applicable \nIeapfltr.dll| 11.0.9600.19502| 710,144| 28-Sep-2019| 05:13| x86| None| Not applicable \nLicmgr10.dll| 11.0.9600.17416| 27,136| 31-Oct-2014| 03:03| x86| None| Not applicable \nIedvtool.dll| 11.0.9600.19502| 772,608| 28-Sep-2019| 06:30| x86| None| Not applicable \nDiagnosticstap.dll| 11.0.9600.17905| 174,592| 15-Jun-2015| 20:52| x86| None| Not applicable \nF12tools.dll| 11.0.9600.17905| 255,488| 15-Jun-2015| 20:51| x86| None| Not applicable \nMsfeedsbs.dll| 11.0.9600.17416| 52,736| 31-Oct-2014| 02:53| x86| None| Not applicable \nMsfeedsbs.mof| Not applicable| 1,574| 21-Aug-2013| 23:49| Not applicable| None| Not applicable \nMsfeedssync.exe| 11.0.9600.17416| 11,264| 31-Oct-2014| 03:25| x86| None| Not applicable \nIeadvpack.dll| 11.0.9600.17416| 112,128| 31-Oct-2014| 03:14| x86| None| Not applicable \nIelowutil.exe| 11.0.9600.19404| 221,184| 10-Jul-2019| 03:06| x86| None| Not applicable \nIeproxy.dll| 11.0.9600.19502| 301,056| 28-Sep-2019| 05:10| x86| None| Not applicable \nIeshims.dll| 11.0.9600.19502| 290,304| 28-Sep-2019| 05:16| x86| None| Not applicable \nIexpress.exe| 11.0.9600.17416| 152,064| 31-Oct-2014| 03:27| x86| None| Not applicable \nWextract.exe| 11.0.9600.17416| 137,728| 31-Oct-2014| 03:28| x86| None| Not applicable \nImgutil.dll| 11.0.9600.17416| 40,448| 31-Oct-2014| 02:24| x86| None| Not applicable \nExtexport.exe| 11.0.9600.17416| 25,600| 31-Oct-2014| 03:20| x86| None| Not applicable \nJsdbgui.dll| 11.0.9600.18895| 459,776| 02-Jan-2018| 04:27| x86| None| Not applicable \nJsprofilerui.dll| 11.0.9600.18895| 579,584| 02-Jan-2018| 04:27| x86| SPR| X86_MICROSOFT-WINDOWS-IE-JSP \nMshtmldac.dll| 11.0.9600.19502| 64,000| 28-Sep-2019| 06:10| x86| None| Not applicable \nNetworkinspection.dll| 11.0.9600.19404| 1,075,200| 10-Jul-2019| 02:45| x86| SPE| X86_MICROSOFT-WINDOWS-IE-NETWORKINSP \nMsdbg2.dll| 12.0.41202.0| 315,008| 30-Sep-2014| 23:00| x86| None| Not applicable \nPdm.dll| 12.0.41202.0| 442,992| 30-Sep-2014| 23:00| x86| None| Not applicable \nPdmproxy100.dll| 12.0.41202.0| 99,984| 30-Sep-2014| 23:00| x86| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 24-Sep-2013| 02:25| Not applicable| None| Not applicable \nMsrating.dll| 11.0.9600.19502| 168,960| 28-Sep-2019| 05:46| x86| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 24-Sep-2013| 02:26| Not applicable| None| Not applicable \nIertutil.dll| 11.0.9600.19502| 2,302,464| 28-Sep-2019| 06:09| x86| None| Not applicable \nInseng.dll| 11.0.9600.17416| 91,136| 31-Oct-2014| 02:56| x86| None| Not applicable \nVgx.dll| 11.0.9600.19502| 817,664| 28-Sep-2019| 05:46| x86| None| Not applicable \nUrl.dll| 11.0.9600.17416| 235,520| 31-Oct-2014| 03:24| x86| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,673,728| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,728,000| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,432| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,670,656| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,921,536| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,997,312| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,640,960| 28-Sep-2019| 07:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,639,936| 10-Jul-2019| 03:59| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,880| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,863,168| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,668,608| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,800| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,627,136| 28-Sep-2019| 07:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,678,336| 10-Jul-2019| 04:50| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,690,112| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,914,368| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 28-Sep-2019| 07:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,761,280| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,899,008| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,890,816| 10-Jul-2019| 04:55| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,658,880| 10-Jul-2019| 04:56| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 28-Sep-2019| 07:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,700,352| 10-Jul-2019| 04:54| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,682,944| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,906,176| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,701,888| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,924,096| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,912,320| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 28-Sep-2019| 07:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,667,072| 10-Jul-2019| 04:51| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,922,560| 28-Sep-2019| 07:41| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,886,208| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,932,288| 10-Jul-2019| 04:43| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,705,472| 28-Sep-2019| 07:41| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 04:52| Not applicable| None| Not applicable \nIeframe.dll.mui| 11.0.9600.19404| 1,497,600| 10-Jul-2019| 04:53| Not applicable| None| Not applicable \nIeinstal.exe| 11.0.9600.18921| 475,648| 10-Feb-2018| 05:35| x86| None| Not applicable \nInetcomm.dll| 6.3.9600.19502| 880,640| 28-Sep-2019| 05:41| x86| None| Not applicable \nInetres.dll| 6.3.9600.16384| 84,480| 22-Aug-2013| 04:14| x86| None| Not applicable \n**Internet Explorer 11**\n\n## Internet Explorer 11 on all supported x86-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform** \n---|---|---|---|---|--- \nUrlmon.dll| 11.0.9600.19502| 1,331,712| 28-Sep-2019| 05:14| x86 \nIexplore.exe| 11.0.9600.19502| 810,376| 30-Sep-2019| 02:05| x86 \nWininet.dll.mui| 11.0.9600.19502| 46,592| 30-Sep-2019| 02:06| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:07| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 56,320| 30-Sep-2019| 02:09| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 57,856| 30-Sep-2019| 02:10| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:11| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:11| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:12| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 55,296| 30-Sep-2019| 02:13| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 02:14| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:14| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:15| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 02:16| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 02:17| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 02:18| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:19| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:20| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:20| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:21| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,760| 30-Sep-2019| 02:22| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:23| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:23| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:24| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:25| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 02:26| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:26| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:27| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:28| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:29| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:29| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:30| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:31| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:32| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:33| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,058,752| 28-Sep-2019| 05:36| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 307,200| 30-Sep-2019| 02:06| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,888| 30-Sep-2019| 02:07| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,304| 30-Sep-2019| 02:08| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 02:08| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,008| 30-Sep-2019| 02:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 303,104| 30-Sep-2019| 02:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 282,112| 30-Sep-2019| 03:26| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 02:11| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 283,648| 30-Sep-2019| 02:11| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 291,840| 30-Sep-2019| 02:12| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,520| 30-Sep-2019| 02:13| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 275,968| 30-Sep-2019| 02:14| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 02:15| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,376| 30-Sep-2019| 02:15| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 02:17| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 258,048| 30-Sep-2019| 02:17| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 256,512| 30-Sep-2019| 02:18| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 02:19| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,256| 30-Sep-2019| 02:20| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 285,184| 30-Sep-2019| 02:20| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 02:21| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 297,472| 30-Sep-2019| 02:22| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 02:23| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 02:24| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 02:24| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 02:25| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 02:26| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 02:27| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,768| 30-Sep-2019| 02:27| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,208| 30-Sep-2019| 02:28| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 281,600| 30-Sep-2019| 02:29| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,720| 30-Sep-2019| 02:30| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,352| 30-Sep-2019| 02:30| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 242,176| 30-Sep-2019| 02:31| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 02:32| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 02:33| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 46,080| 30-Sep-2019| 02:06| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:07| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:08| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:08| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:09| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:10| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:11| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:11| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:12| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:13| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 02:14| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:14| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:15| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:16| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,936| 30-Sep-2019| 02:17| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 02:18| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:19| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:19| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:20| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:21| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:22| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:23| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:23| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:24| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:25| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:26| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:26| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:27| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:28| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 02:29| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:30| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 02:30| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:31| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:32| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:33| Not applicable \nJsproxy.dll| 11.0.9600.19502| 47,104| 28-Sep-2019| 06:06| x86 \nWininet.dll| 11.0.9600.19502| 4,387,840| 28-Sep-2019| 05:18| x86 \nInetcpl.cpl.mui| 11.0.9600.19502| 114,176| 30-Sep-2019| 02:06| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 02:07| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,928| 30-Sep-2019| 02:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,880| 30-Sep-2019| 02:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,048| 30-Sep-2019| 02:09| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 138,240| 30-Sep-2019| 02:10| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 114,688| 30-Sep-2019| 03:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 131,584| 30-Sep-2019| 02:11| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 117,760| 30-Sep-2019| 02:11| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,368| 30-Sep-2019| 02:12| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 134,144| 30-Sep-2019| 02:13| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 107,008| 30-Sep-2019| 02:14| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 02:15| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 127,488| 30-Sep-2019| 02:15| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,512| 30-Sep-2019| 02:16| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 88,576| 30-Sep-2019| 02:17| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 82,944| 30-Sep-2019| 02:18| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 02:19| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 02:19| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 120,320| 30-Sep-2019| 02:20| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 02:21| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:22| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,952| 30-Sep-2019| 02:23| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:23| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,000| 30-Sep-2019| 02:24| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:25| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 30-Sep-2019| 02:27| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 121,856| 30-Sep-2019| 02:28| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 115,712| 30-Sep-2019| 02:29| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:30| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 02:30| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 72,704| 30-Sep-2019| 02:31| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 02:32| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 02:33| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 28-Sep-2019| 03:46| Not applicable \nMshtml.dll| 11.0.9600.19502| 20,290,048| 28-Sep-2019| 06:30| x86 \nMshtml.tlb| 11.0.9600.19502| 2,724,864| 28-Sep-2019| 06:24| Not applicable \nIeproxy.dll| 11.0.9600.19502| 301,056| 28-Sep-2019| 05:10| x86 \nIeshims.dll| 11.0.9600.19502| 290,304| 28-Sep-2019| 05:16| x86 \nIertutil.dll| 11.0.9600.19502| 2,302,464| 28-Sep-2019| 06:09| x86 \nSqmapi.dll| 6.2.9200.16384| 228,232| 30-Sep-2019| 02:05| x86 \nIeframe.dll.mui| 11.0.9600.19502| 1,673,216| 30-Sep-2019| 02:06| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,728,000| 30-Sep-2019| 02:07| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 02:08| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,670,656| 30-Sep-2019| 02:09| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,024| 30-Sep-2019| 02:09| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,996,800| 30-Sep-2019| 02:10| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,639,936| 30-Sep-2019| 03:26| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,880| 30-Sep-2019| 02:11| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,862,656| 30-Sep-2019| 02:12| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,668,608| 30-Sep-2019| 02:13| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,932,800| 30-Sep-2019| 02:13| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,626,624| 30-Sep-2019| 02:14| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,677,824| 30-Sep-2019| 02:15| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,689,600| 30-Sep-2019| 02:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,368| 30-Sep-2019| 02:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 30-Sep-2019| 02:18| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,760,256| 30-Sep-2019| 02:18| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,899,008| 30-Sep-2019| 02:19| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,890,816| 30-Sep-2019| 02:20| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,658,880| 30-Sep-2019| 02:21| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 30-Sep-2019| 02:22| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,699,840| 30-Sep-2019| 02:22| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 02:23| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,906,176| 30-Sep-2019| 02:24| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,376| 30-Sep-2019| 02:25| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,923,584| 30-Sep-2019| 02:25| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,912,320| 30-Sep-2019| 02:26| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 02:27| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 30-Sep-2019| 02:28| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,667,072| 30-Sep-2019| 02:28| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,536| 30-Sep-2019| 02:29| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 02:30| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,931,264| 30-Sep-2019| 02:31| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,888| 30-Sep-2019| 02:32| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 02:32| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 02:33| Not applicable \nIeframe.dll| 11.0.9600.19502| 13,808,128| 28-Sep-2019| 05:33| x86 \nIeframe.ptxml| Not applicable| 24,486| 28-Sep-2019| 03:46| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:06| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:07| Not applicable \nInetres.adml| Not applicable| 520,402| 30-Sep-2019| 02:08| Not applicable \nInetres.adml| Not applicable| 493,824| 30-Sep-2019| 02:08| Not applicable \nInetres.adml| Not applicable| 546,075| 30-Sep-2019| 02:09| Not applicable \nInetres.adml| Not applicable| 932,524| 30-Sep-2019| 02:10| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:26| Not applicable \nInetres.adml| Not applicable| 537,883| 30-Sep-2019| 02:11| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:11| Not applicable \nInetres.adml| Not applicable| 520,546| 30-Sep-2019| 02:12| Not applicable \nInetres.adml| Not applicable| 569,543| 30-Sep-2019| 02:13| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:14| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:15| Not applicable \nInetres.adml| Not applicable| 564,361| 30-Sep-2019| 02:15| Not applicable \nInetres.adml| Not applicable| 542,373| 30-Sep-2019| 02:16| Not applicable \nInetres.adml| Not applicable| 631,643| 30-Sep-2019| 02:17| Not applicable \nInetres.adml| Not applicable| 519,433| 30-Sep-2019| 02:18| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:19| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:20| Not applicable \nInetres.adml| Not applicable| 482,894| 30-Sep-2019| 02:20| Not applicable \nInetres.adml| Not applicable| 542,623| 30-Sep-2019| 02:21| Not applicable \nInetres.adml| Not applicable| 552,611| 30-Sep-2019| 02:22| Not applicable \nInetres.adml| Not applicable| 529,235| 30-Sep-2019| 02:23| Not applicable \nInetres.adml| Not applicable| 535,760| 30-Sep-2019| 02:23| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:24| Not applicable \nInetres.adml| Not applicable| 794,398| 30-Sep-2019| 02:25| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:26| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:26| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:27| Not applicable \nInetres.adml| Not applicable| 498,475| 30-Sep-2019| 02:28| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:29| Not applicable \nInetres.adml| Not applicable| 515,774| 30-Sep-2019| 02:30| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:30| Not applicable \nInetres.adml| Not applicable| 415,413| 30-Sep-2019| 02:31| Not applicable \nInetres.adml| Not applicable| 431,992| 30-Sep-2019| 02:32| Not applicable \nInetres.adml| Not applicable| 431,992| 30-Sep-2019| 02:33| Not applicable \nInetres.admx| Not applicable| 1,672,213| 28-Sep-2019| 03:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,184| 30-Sep-2019| 02:06| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:08| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:09| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 37,888| 30-Sep-2019| 02:10| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:25| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:11| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:11| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:13| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:13| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 27,648| 30-Sep-2019| 02:14| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:15| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:15| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,792| 30-Sep-2019| 02:16| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 23,040| 30-Sep-2019| 02:17| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 22,016| 30-Sep-2019| 02:18| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:19| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:20| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 31,232| 30-Sep-2019| 02:20| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:21| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 02:22| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:23| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:23| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:24| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,816| 30-Sep-2019| 02:25| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:26| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,256| 30-Sep-2019| 02:26| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:27| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:28| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:29| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,384| 30-Sep-2019| 02:31| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 02:32| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 02:33| Not applicable \nJscript9.dll| 11.0.9600.19502| 4,112,384| 28-Sep-2019| 05:39| x86 \nJscript9diag.dll| 11.0.9600.19502| 620,032| 28-Sep-2019| 06:02| x86 \nJscript.dll| 5.8.9600.19502| 659,968| 28-Sep-2019| 06:02| x86 \nVbscript.dll| 5.8.9600.19502| 496,128| 28-Sep-2019| 06:12| x86 \n \n## Internet Explorer 11 on all supported x64-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform** \n---|---|---|---|---|--- \nUrlmon.dll| 11.0.9600.19502| 1,566,208| 28-Sep-2019| 05:31| x64 \nIexplore.exe| 11.0.9600.19502| 810,376| 30-Sep-2019| 02:53| x64 \nWininet.dll.mui| 11.0.9600.19502| 46,592| 30-Sep-2019| 02:54| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:54| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:55| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:56| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 56,320| 30-Sep-2019| 02:57| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 57,856| 30-Sep-2019| 02:57| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 04:00| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:59| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:59| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:00| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 55,296| 30-Sep-2019| 03:00| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 03:01| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 03:02| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 03:03| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 03:03| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 03:04| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 03:05| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 03:06| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 03:07| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 03:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 03:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,760| 30-Sep-2019| 03:09| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 03:10| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 03:10| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 03:11| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 03:12| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 03:12| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 03:13| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 03:14| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 03:15| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 03:15| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 03:16| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 03:17| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 03:18| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 03:18| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 03:19| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,132,992| 28-Sep-2019| 05:54| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 307,200| 30-Sep-2019| 02:54| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,888| 30-Sep-2019| 02:55| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,304| 30-Sep-2019| 02:55| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 02:56| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,008| 30-Sep-2019| 02:57| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 303,104| 30-Sep-2019| 02:58| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 282,112| 30-Sep-2019| 04:00| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 02:58| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 283,648| 30-Sep-2019| 02:59| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 291,840| 30-Sep-2019| 03:00| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,520| 30-Sep-2019| 03:01| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 275,968| 30-Sep-2019| 03:01| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 03:02| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,376| 30-Sep-2019| 03:03| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 03:04| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 258,048| 30-Sep-2019| 03:04| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 256,512| 30-Sep-2019| 03:05| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 03:06| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,256| 30-Sep-2019| 03:07| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 285,184| 30-Sep-2019| 03:07| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 03:08| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 297,472| 30-Sep-2019| 03:09| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 03:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 03:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 03:11| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 03:12| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 03:12| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 03:13| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,768| 30-Sep-2019| 03:14| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,208| 30-Sep-2019| 03:15| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 281,600| 30-Sep-2019| 03:16| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,720| 30-Sep-2019| 03:16| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,352| 30-Sep-2019| 03:17| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 242,176| 30-Sep-2019| 03:18| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 03:19| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 03:19| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 46,080| 30-Sep-2019| 02:54| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:55| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:55| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:56| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:57| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:57| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 04:00| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:58| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:59| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:00| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 03:00| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 03:01| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:02| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:03| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 03:03| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,936| 30-Sep-2019| 03:04| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 03:05| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 03:06| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 03:07| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 03:07| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 03:08| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 03:09| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 03:10| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 03:10| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:11| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 03:12| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 03:13| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 03:13| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 03:14| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 03:15| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 03:16| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 03:16| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 03:17| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 03:18| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 03:18| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 03:19| Not applicable \nJsproxy.dll| 11.0.9600.19502| 54,784| 28-Sep-2019| 06:38| x64 \nWininet.dll| 11.0.9600.19502| 4,859,904| 28-Sep-2019| 05:42| x64 \nInetcpl.cpl.mui| 11.0.9600.19502| 114,176| 30-Sep-2019| 02:54| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 02:54| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,928| 30-Sep-2019| 02:55| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,880| 30-Sep-2019| 02:56| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,048| 30-Sep-2019| 02:57| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 138,240| 30-Sep-2019| 02:58| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 114,688| 30-Sep-2019| 04:00| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 131,584| 30-Sep-2019| 02:58| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 117,760| 30-Sep-2019| 02:59| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,368| 30-Sep-2019| 03:00| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 134,144| 30-Sep-2019| 03:00| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 107,008| 30-Sep-2019| 03:01| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 03:02| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 127,488| 30-Sep-2019| 03:03| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,512| 30-Sep-2019| 03:03| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 88,576| 30-Sep-2019| 03:04| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 82,944| 30-Sep-2019| 03:05| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 03:06| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 03:07| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 120,320| 30-Sep-2019| 03:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 03:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 03:09| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,952| 30-Sep-2019| 03:10| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 03:10| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,000| 30-Sep-2019| 03:11| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 03:12| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 03:13| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 03:14| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 30-Sep-2019| 03:14| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 121,856| 30-Sep-2019| 03:15| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 115,712| 30-Sep-2019| 03:16| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 03:17| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 03:17| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 72,704| 30-Sep-2019| 03:18| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 03:18| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 03:19| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 28-Sep-2019| 03:48| Not applicable \nMshtml.dll| 11.0.9600.19502| 25,752,576| 28-Sep-2019| 07:11| x64 \nMshtml.tlb| 11.0.9600.19502| 2,724,864| 28-Sep-2019| 06:59| Not applicable \nIeproxy.dll| 11.0.9600.19502| 805,376| 28-Sep-2019| 05:16| x64 \nIeshims.dll| 11.0.9600.19502| 386,560| 28-Sep-2019| 05:25| x64 \nIertutil.dll| 11.0.9600.19502| 2,909,184| 28-Sep-2019| 06:47| x64 \nSqmapi.dll| 6.2.9200.16384| 286,088| 30-Sep-2019| 02:53| x64 \nIeframe.dll.mui| 11.0.9600.19502| 1,673,216| 30-Sep-2019| 02:54| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,728,000| 30-Sep-2019| 02:55| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 02:56| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,670,656| 30-Sep-2019| 02:56| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,024| 30-Sep-2019| 02:57| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,996,800| 30-Sep-2019| 02:58| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,639,936| 30-Sep-2019| 04:00| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,880| 30-Sep-2019| 02:59| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,862,656| 30-Sep-2019| 02:59| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,668,608| 30-Sep-2019| 03:00| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,932,800| 30-Sep-2019| 03:01| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,626,624| 30-Sep-2019| 03:02| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,677,824| 30-Sep-2019| 03:02| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,689,600| 30-Sep-2019| 03:03| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,368| 30-Sep-2019| 03:04| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 30-Sep-2019| 03:05| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,760,256| 30-Sep-2019| 03:06| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,899,008| 30-Sep-2019| 03:06| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,890,816| 30-Sep-2019| 03:07| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,658,880| 30-Sep-2019| 03:08| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 30-Sep-2019| 03:08| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,699,840| 30-Sep-2019| 03:09| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 03:10| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,906,176| 30-Sep-2019| 03:11| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,376| 30-Sep-2019| 03:11| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,923,584| 30-Sep-2019| 03:12| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,912,320| 30-Sep-2019| 03:13| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 03:14| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 30-Sep-2019| 03:14| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,667,072| 30-Sep-2019| 03:15| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,536| 30-Sep-2019| 03:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 03:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,931,264| 30-Sep-2019| 03:17| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,888| 30-Sep-2019| 03:18| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 03:19| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 03:20| Not applicable \nIeframe.dll| 11.0.9600.19502| 15,413,760| 28-Sep-2019| 05:52| x64 \nIeframe.ptxml| Not applicable| 24,486| 28-Sep-2019| 03:47| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:54| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:55| Not applicable \nInetres.adml| Not applicable| 520,402| 30-Sep-2019| 02:55| Not applicable \nInetres.adml| Not applicable| 493,824| 30-Sep-2019| 02:56| Not applicable \nInetres.adml| Not applicable| 546,075| 30-Sep-2019| 02:57| Not applicable \nInetres.adml| Not applicable| 932,524| 30-Sep-2019| 02:57| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 04:00| Not applicable \nInetres.adml| Not applicable| 537,883| 30-Sep-2019| 02:58| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 02:59| Not applicable \nInetres.adml| Not applicable| 520,546| 30-Sep-2019| 03:00| Not applicable \nInetres.adml| Not applicable| 569,543| 30-Sep-2019| 03:01| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:01| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:02| Not applicable \nInetres.adml| Not applicable| 564,361| 30-Sep-2019| 03:03| Not applicable \nInetres.adml| Not applicable| 542,373| 30-Sep-2019| 03:04| Not applicable \nInetres.adml| Not applicable| 631,643| 30-Sep-2019| 03:04| Not applicable \nInetres.adml| Not applicable| 519,433| 30-Sep-2019| 03:05| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:06| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:07| Not applicable \nInetres.adml| Not applicable| 482,894| 30-Sep-2019| 03:07| Not applicable \nInetres.adml| Not applicable| 542,623| 30-Sep-2019| 03:08| Not applicable \nInetres.adml| Not applicable| 552,611| 30-Sep-2019| 03:09| Not applicable \nInetres.adml| Not applicable| 529,235| 30-Sep-2019| 03:10| Not applicable \nInetres.adml| Not applicable| 535,760| 30-Sep-2019| 03:10| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:11| Not applicable \nInetres.adml| Not applicable| 794,398| 30-Sep-2019| 03:12| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:13| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:13| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:14| Not applicable \nInetres.adml| Not applicable| 498,475| 30-Sep-2019| 03:15| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:15| Not applicable \nInetres.adml| Not applicable| 515,774| 30-Sep-2019| 03:16| Not applicable \nInetres.adml| Not applicable| 452,656| 30-Sep-2019| 03:17| Not applicable \nInetres.adml| Not applicable| 415,413| 30-Sep-2019| 03:18| Not applicable \nInetres.adml| Not applicable| 431,992| 30-Sep-2019| 03:19| Not applicable \nInetres.adml| Not applicable| 431,992| 30-Sep-2019| 03:19| Not applicable \nInetres.admx| Not applicable| 1,672,213| 28-Sep-2019| 03:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,184| 30-Sep-2019| 02:54| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:55| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:55| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:56| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:57| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 37,888| 30-Sep-2019| 02:57| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 04:00| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:58| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:59| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 03:00| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 03:00| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 27,648| 30-Sep-2019| 03:02| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:02| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 03:03| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,792| 30-Sep-2019| 03:03| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 23,040| 30-Sep-2019| 03:04| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 22,016| 30-Sep-2019| 03:05| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:06| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 31,232| 30-Sep-2019| 03:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 03:08| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 03:09| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 03:10| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 03:10| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:11| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,816| 30-Sep-2019| 03:12| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 03:12| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,256| 30-Sep-2019| 03:13| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:14| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 03:15| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:16| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 03:16| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:17| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,384| 30-Sep-2019| 03:18| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 03:19| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 03:19| Not applicable \nJscript9.dll| 11.0.9600.19502| 5,500,928| 28-Sep-2019| 06:33| x64 \nJscript9diag.dll| 11.0.9600.19502| 814,080| 28-Sep-2019| 06:33| x64 \nJscript.dll| 5.8.9600.19502| 793,088| 28-Sep-2019| 06:33| x64 \nVbscript.dll| 5.8.9600.19502| 579,584| 28-Sep-2019| 06:45| x64 \nIexplore.exe| 11.0.9600.19502| 810,376| 30-Sep-2019| 02:05| x86 \nMshtml.dll| 11.0.9600.19502| 20,290,048| 28-Sep-2019| 06:30| x86 \nMshtml.tlb| 11.0.9600.19502| 2,724,864| 28-Sep-2019| 06:24| Not applicable \nWow64_microsoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 28-Sep-2019| 03:50| Not applicable \nIe9props.propdesc| Not applicable| 2,843| 27-Oct-2017| 23:29| Not applicable \nIeframe.dll| 11.0.9600.19502| 13,808,128| 28-Sep-2019| 05:33| x86 \nWow64_ieframe.ptxml| Not applicable| 24,486| 28-Sep-2019| 03:50| Not applicable \nJscript9.dll| 11.0.9600.19502| 4,112,384| 28-Sep-2019| 05:39| x86 \nJscript9diag.dll| 11.0.9600.19502| 620,032| 28-Sep-2019| 06:02| x86 \nJscript.dll| 5.8.9600.19502| 659,968| 28-Sep-2019| 06:02| x86 \nVbscript.dll| 5.8.9600.19502| 496,128| 28-Sep-2019| 06:12| x86 \nUrlmon.dll| 11.0.9600.19502| 1,331,712| 28-Sep-2019| 05:14| x86 \nWininet.dll.mui| 11.0.9600.19502| 46,592| 30-Sep-2019| 02:06| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:07| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:08| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 56,320| 30-Sep-2019| 02:09| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 57,856| 30-Sep-2019| 02:10| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 03:26| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:11| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:11| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:12| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 55,296| 30-Sep-2019| 02:13| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 02:14| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:14| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:15| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 02:16| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 02:17| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 02:18| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:19| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:20| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:20| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:21| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,760| 30-Sep-2019| 02:22| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:23| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:23| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:24| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:25| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 53,248| 30-Sep-2019| 02:26| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 52,736| 30-Sep-2019| 02:26| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:27| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:28| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:29| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:29| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:30| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:31| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:32| Not applicable \nWininet.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:33| Not applicable \nInetcpl.cpl| 11.0.9600.19502| 2,058,752| 28-Sep-2019| 05:36| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 307,200| 30-Sep-2019| 02:06| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,888| 30-Sep-2019| 02:07| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,304| 30-Sep-2019| 02:08| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 02:08| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,008| 30-Sep-2019| 02:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 303,104| 30-Sep-2019| 02:10| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 282,112| 30-Sep-2019| 03:26| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 02:11| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 283,648| 30-Sep-2019| 02:11| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 291,840| 30-Sep-2019| 02:12| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 299,520| 30-Sep-2019| 02:13| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 275,968| 30-Sep-2019| 02:14| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 02:15| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 293,376| 30-Sep-2019| 02:15| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 296,960| 30-Sep-2019| 02:17| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 258,048| 30-Sep-2019| 02:17| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 256,512| 30-Sep-2019| 02:18| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 289,280| 30-Sep-2019| 02:19| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,256| 30-Sep-2019| 02:20| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 285,184| 30-Sep-2019| 02:20| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 02:21| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 297,472| 30-Sep-2019| 02:22| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 02:23| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 295,424| 30-Sep-2019| 02:24| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 02:24| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 294,400| 30-Sep-2019| 02:25| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,864| 30-Sep-2019| 02:26| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 290,816| 30-Sep-2019| 02:27| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 288,768| 30-Sep-2019| 02:27| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,208| 30-Sep-2019| 02:28| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 281,600| 30-Sep-2019| 02:29| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 286,720| 30-Sep-2019| 02:30| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 292,352| 30-Sep-2019| 02:30| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 242,176| 30-Sep-2019| 02:31| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 02:32| Not applicable \nMshtml.dll.mui| 11.0.9600.19502| 243,200| 30-Sep-2019| 02:33| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 46,080| 30-Sep-2019| 02:06| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:07| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:08| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:08| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,712| 30-Sep-2019| 02:09| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 54,272| 30-Sep-2019| 02:10| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 03:26| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:11| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:11| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:12| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:13| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 45,056| 30-Sep-2019| 02:14| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:14| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:15| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:16| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,936| 30-Sep-2019| 02:17| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 39,424| 30-Sep-2019| 02:18| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:19| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 47,616| 30-Sep-2019| 02:19| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:20| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 51,200| 30-Sep-2019| 02:21| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,688| 30-Sep-2019| 02:22| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:23| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:23| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:24| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:25| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 50,176| 30-Sep-2019| 02:26| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:26| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,664| 30-Sep-2019| 02:27| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,640| 30-Sep-2019| 02:28| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 02:29| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 49,152| 30-Sep-2019| 02:30| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 48,128| 30-Sep-2019| 02:30| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:31| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:32| Not applicable \nUrlmon.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:33| Not applicable \nJsproxy.dll| 11.0.9600.19502| 47,104| 28-Sep-2019| 06:06| x86 \nWininet.dll| 11.0.9600.19502| 4,387,840| 28-Sep-2019| 05:18| x86 \nInetcpl.cpl.mui| 11.0.9600.19502| 114,176| 30-Sep-2019| 02:06| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 02:07| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,928| 30-Sep-2019| 02:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,880| 30-Sep-2019| 02:08| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,048| 30-Sep-2019| 02:09| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 138,240| 30-Sep-2019| 02:10| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 114,688| 30-Sep-2019| 03:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 131,584| 30-Sep-2019| 02:11| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 117,760| 30-Sep-2019| 02:11| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 122,368| 30-Sep-2019| 02:12| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 134,144| 30-Sep-2019| 02:13| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 107,008| 30-Sep-2019| 02:14| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 02:15| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 127,488| 30-Sep-2019| 02:15| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,512| 30-Sep-2019| 02:16| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 88,576| 30-Sep-2019| 02:17| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 82,944| 30-Sep-2019| 02:18| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 02:19| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,392| 30-Sep-2019| 02:19| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 120,320| 30-Sep-2019| 02:20| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 130,560| 30-Sep-2019| 02:21| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:22| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,952| 30-Sep-2019| 02:23| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:23| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 128,000| 30-Sep-2019| 02:24| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:25| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 129,024| 30-Sep-2019| 02:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:26| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 124,416| 30-Sep-2019| 02:27| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 121,856| 30-Sep-2019| 02:28| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 115,712| 30-Sep-2019| 02:29| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 123,904| 30-Sep-2019| 02:30| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 125,440| 30-Sep-2019| 02:30| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 72,704| 30-Sep-2019| 02:31| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 02:32| Not applicable \nInetcpl.cpl.mui| 11.0.9600.19502| 73,728| 30-Sep-2019| 02:33| Not applicable \nIeproxy.dll| 11.0.9600.19502| 301,056| 28-Sep-2019| 05:10| x86 \nIeshims.dll| 11.0.9600.19502| 290,304| 28-Sep-2019| 05:16| x86 \nIertutil.dll| 11.0.9600.19502| 2,302,464| 28-Sep-2019| 06:09| x86 \nSqmapi.dll| 6.2.9200.16384| 228,232| 30-Sep-2019| 02:05| x86 \nIeframe.dll.mui| 11.0.9600.19502| 1,673,216| 30-Sep-2019| 02:06| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,728,000| 30-Sep-2019| 02:07| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 02:08| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,670,656| 30-Sep-2019| 02:09| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,024| 30-Sep-2019| 02:09| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,996,800| 30-Sep-2019| 02:10| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,639,936| 30-Sep-2019| 03:26| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,880| 30-Sep-2019| 02:11| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,862,656| 30-Sep-2019| 02:12| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,668,608| 30-Sep-2019| 02:13| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,932,800| 30-Sep-2019| 02:13| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,626,624| 30-Sep-2019| 02:14| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,677,824| 30-Sep-2019| 02:15| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,689,600| 30-Sep-2019| 02:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,914,368| 30-Sep-2019| 02:16| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,777,664| 30-Sep-2019| 02:18| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,760,256| 30-Sep-2019| 02:18| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,899,008| 30-Sep-2019| 02:19| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,890,816| 30-Sep-2019| 02:20| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,658,880| 30-Sep-2019| 02:21| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,908,736| 30-Sep-2019| 02:22| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,699,840| 30-Sep-2019| 02:22| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,682,432| 30-Sep-2019| 02:23| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,906,176| 30-Sep-2019| 02:24| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,376| 30-Sep-2019| 02:25| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,923,584| 30-Sep-2019| 02:25| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,912,320| 30-Sep-2019| 02:26| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 02:27| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,893,376| 30-Sep-2019| 02:28| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,667,072| 30-Sep-2019| 02:28| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,921,536| 30-Sep-2019| 02:29| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,886,208| 30-Sep-2019| 02:30| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,931,264| 30-Sep-2019| 02:31| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,701,888| 30-Sep-2019| 02:32| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 02:32| Not applicable \nIeframe.dll.mui| 11.0.9600.19502| 1,493,504| 30-Sep-2019| 02:33| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,184| 30-Sep-2019| 02:06| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:07| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:08| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,328| 30-Sep-2019| 02:09| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 37,888| 30-Sep-2019| 02:10| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 03:25| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:11| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:11| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:13| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:13| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 27,648| 30-Sep-2019| 02:14| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:15| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:15| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,792| 30-Sep-2019| 02:16| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 23,040| 30-Sep-2019| 02:17| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 22,016| 30-Sep-2019| 02:18| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:19| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:20| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 31,232| 30-Sep-2019| 02:20| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,304| 30-Sep-2019| 02:21| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 35,840| 30-Sep-2019| 02:22| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:23| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:23| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:24| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 34,816| 30-Sep-2019| 02:25| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 33,280| 30-Sep-2019| 02:26| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,256| 30-Sep-2019| 02:26| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:27| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 32,768| 30-Sep-2019| 02:28| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:29| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 30,720| 30-Sep-2019| 02:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 29,696| 30-Sep-2019| 02:30| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,384| 30-Sep-2019| 02:31| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 02:32| Not applicable \nJscript9.dll.mui| 11.0.9600.19502| 16,896| 30-Sep-2019| 02:33| Not applicable \n**Internet Explorer 10**\n\n## Internet Explorer 10 on all supported x64-based versions\n\n**File name**| **File version**| **File size**| **Date**| **Time**| **Platform**| **SP requirement**| **Service branch** \n---|---|---|---|---|---|---|--- \nWindows.ui.xaml.dll| 6.2.9200.22722| 13,658,112| 26-Mar-2019| 04:09| x64| None| Not applicable \nHlink.dll| 6.2.9200.22522| 96,256| 19-Jul-2018| 05:09| x64| None| Not applicable \nUrlmon.dll| 10.0.9200.22885| 1,395,712| 28-Sep-2019| 07:09| x64| None| Not applicable \nIexplore.exe| 10.0.9200.22387| 775,816| 20-Feb-2018| 20:17| x64| None| Not applicable \nHtml.iec| 2019.0.0.22387| 441,856| 20-Feb-2018| 17:49| Not applicable| None| Not applicable \nInetcpl.cpl| 10.0.9200.22858| 1,509,376| 27-Aug-2019| 04:55| Not applicable| None| Not applicable \nJsproxy.dll| 10.0.9200.22387| 53,248| 20-Feb-2018| 19:46| x64| None| Not applicable \nWininet.dll| 10.0.9200.22885| 2,247,168| 28-Sep-2019| 07:09| x64| None| Not applicable \nIdctrls.dll| 6.2.9200.22671| 75,776| 24-Jan-2019| 05:13| x64| None| Not applicable \nIedkcs32.dll| 18.0.9200.22695| 255,488| 12-Feb-2019| 17:29| x64| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:23| Not applicable| None| Not applicable \nIe9props.propdesc| Not applicable| 2,843| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.8411.0| 1,400,416| 21-Nov-2017| 07:23| Not applicable| None| Not applicable \nIeapfltr.dll| 10.0.9200.22885| 762,368| 28-Sep-2019| 07:09| x64| None| Not applicable \nTdc.ocx| 10.0.9200.22387| 77,312| 20-Feb-2018| 19:47| x64| None| Not applicable \nDxtmsft.dll| 10.0.9200.22387| 452,608| 20-Feb-2018| 19:46| x64| None| Not applicable \nDxtrans.dll| 10.0.9200.22722| 281,088| 26-Mar-2019| 04:09| x64| None| Not applicable \nMsfeeds.dll| 10.0.9200.22885| 603,648| 28-Sep-2019| 07:09| x64| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 20-Feb-2018| 16:02| Not applicable| None| Not applicable \nMshtmled.dll| 10.0.9200.22695| 96,768| 12-Feb-2019| 17:29| x64| None| Not applicable \nMicrosoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 20-Feb-2018| 15:58| Not applicable| None| Not applicable \nMshtml.dll| 10.0.9200.22885| 20,150,272| 28-Sep-2019| 07:09| x64| None| Not applicable \nMshtml.tlb| 10.0.9200.22387| 2,706,432| 20-Feb-2018| 18:00| Not applicable| None| Not applicable \nIelowutil.exe| 10.0.9200.22387| 223,744| 20-Feb-2018| 19:47| x64| None| Not applicable \nIeproxy.dll| 10.0.9200.22671| 704,000| 24-Jan-2019| 05:13| x64| None| Not applicable \nIeshims.dll| 10.0.9200.22387| 365,568| 20-Feb-2018| 19:46| x64| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nMsrating.dll| 10.0.9200.22387| 197,120| 20-Feb-2018| 19:46| x64| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nIertutil.dll| 10.0.9200.22858| 2,689,536| 27-Aug-2019| 04:55| x64| None| Not applicable \nIe4uinit.exe| 10.0.9200.22387| 51,712| 20-Feb-2018| 19:47| x64| None| Not applicable \nIernonce.dll| 10.0.9200.22387| 39,936| 20-Feb-2018| 19:46| x64| None| Not applicable \nIesetup.dll| 10.0.9200.22387| 67,072| 20-Feb-2018| 19:46| x64| None| Not applicable \nIesysprep.dll| 10.0.9200.22387| 136,704| 20-Feb-2018| 19:46| x64| SPR| AMD64_MICROSOFT-WINDOWS-IE-SYSP \nVgx.dll| 10.0.9200.22695| 1,085,440| 12-Feb-2019| 17:29| x64| None| Not applicable \nIeframe.dll| 10.0.9200.22885| 15,444,480| 28-Sep-2019| 07:09| x64| None| Not applicable \nIeframe.ptxml| Not applicable| 25,923| 20-Feb-2018| 15:58| Not applicable| None| Not applicable \nIeinstal.exe| 10.0.9200.22858| 493,568| 27-Aug-2019| 04:55| x64| None| Not applicable \nInetres.adml| Not applicable| 496,073| 12-Jun-2018| 20:12| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 471,216| 12-Jun-2018| 20:02| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 521,514| 12-Jun-2018| 18:01| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 891,899| 12-Jun-2018| 17:55| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 431,913| 20-Feb-2018| 19:52| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 513,874| 12-Jun-2018| 20:21| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 499,586| 12-Jun-2018| 19:32| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 544,437| 12-Jun-2018| 19:56| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 539,484| 12-Jun-2018| 19:53| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 518,202| 12-Jun-2018| 19:57| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 603,821| 12-Jun-2018| 17:56| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 499,713| 12-Jun-2018| 20:19| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 460,208| 12-Jun-2018| 18:00| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 519,382| 12-Jun-2018| 17:56| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 527,261| 12-Jun-2018| 17:57| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 505,383| 12-Jun-2018| 17:58| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 511,915| 12-Jun-2018| 18:10| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 761,065| 12-Jun-2018| 18:08| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 481,848| 12-Jun-2018| 17:54| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 492,315| 12-Jun-2018| 17:55| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 395,563| 12-Jun-2018| 18:08| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 411,744| 12-Jun-2018| 18:00| Not applicable| None| Not applicable \nInetres.adml| Not applicable| 411,744| 12-Jun-2018| 17:58| Not applicable| None| Not applicable \nInetres.admx| Not applicable| 1,649,803| 15-Nov-2017| 00:52| Not applicable| None| Not applicable \nJsdebuggeride.dll| 10.0.9200.22387| 148,992| 20-Feb-2018| 19:46| x64| None| Not applicable \nPurchasewindowslicense.dll| 6.2.9200.22885| 562,688| 28-Sep-2019| 07:09| x64| None| Not applicable \nPurchasewindowslicense.exe| 6.2.9200.22671| 22,136| 24-Jan-2019| 05:45| x64| None| Not applicable \nInetcomm.dll| 6.2.9200.22885| 949,760| 28-Sep-2019| 07:09| x64| None| Not applicable \nInetres.dll| 6.2.9200.22387| 84,480| 20-Feb-2018| 17:59| x64| None| Not applicable \nFirstlogonanim.html| Not applicable| 88,435| 06-Jul-2012| 19:56| Not applicable| None| Not applicable \nMsoobefirstlogonanim.dll| 6.2.9200.22671| 47,104| 24-Jan-2019| 05:13| x64| None| Not applicable \nPhotoviewer.dll| 6.2.9200.22858| 1,820,672| 27-Aug-2019| 04:55| x64| None| Not applicable \nJscript9.dll| 10.0.9200.22885| 3,868,672| 28-Sep-2019| 07:09| x64| None| Not applicable \nJscript.dll| 5.8.9200.22885| 853,504| 28-Sep-2019| 07:09| x64| None| Not applicable \nVbscript.dll| 5.8.9200.22885| 596,480| 28-Sep-2019| 07:09| x64| None| Not applicable \nAuthbroker.dll| 6.2.9200.22671| 96,256| 24-Jan-2019| 05:13| x64| None| Not applicable \nAuthhost.exe| 6.2.9200.22752| 122,512| 30-Apr-2019| 04:16| x64| None| Not applicable \nAuthhostproxy.dll| 6.2.9200.16384| 12,288| 26-Jul-2012| 03:05| x64| None| Not applicable \nResources.pri| Not applicable| 8,544| 25-Jul-2012| 23:04| Not applicable| None| Not applicable \nWindows store.lnk| Not applicable| 2,028| 25-Jul-2012| 20:13| Not applicable| None| Not applicable \nWinstore.ui.winmd| Not applicable| 14,336| 03-Jul-2013| 05:05| Not applicable| None| Not applicable \nWinstoreui-ppdlic.xrm-ms| Not applicable| 2,885| 28-Sep-2019| 07:46| Not applicable| None| Not applicable \nWinstoreui.dll| 6.2.9200.22885| 825,344| 28-Sep-2019| 07:09| x64| None| Not applicable \nWindows.applicationmodel.store.dll| 6.2.9200.22671| 198,656| 24-Jan-2019| 05:13| x64| None| Not applicable \nWindows.applicationmodel.store.testingframework.dll| 6.2.9200.22885| 163,840| 28-Sep-2019| 07:09| x64| None| Not applicable \nWsshared.dll| 6.2.9200.22885| 695,808| 28-Sep-2019| 07:09| x64| None| Not applicable \nUxinit.dll| 6.2.9200.22387| 53,760| 20-Feb-2018| 19:46| x64| None| Not applicable \nUxtheme.dll| 6.2.9200.22858| 909,312| 27-Aug-2019| 04:55| x64| None| Not applicable \nWwaapi.dll| 6.2.9200.22695| 116,224| 12-Feb-2019| 17:30| x64| None| Not applicable \nWindowswebapphost.ptxml| Not applicable| 2,055| 20-Sep-2012| 01:44| Not applicable| None| Not applicable \nWwahost.exe| 6.2.9200.22858| 422,912| 27-Aug-2019| 04:55| x64| None| Not applicable \nWindowslivelogin.dll| 6.2.9200.22671| 305,152| 24-Jan-2019| 05:13| x64| None| Not applicable \nIexplore.exe| 10.0.9200.22387| 770,696| 20-Feb-2018| 19:06| x86| None| Not applicable \nHtml.iec| 2019.0.0.22387| 361,984| 20-Feb-2018| 17:24| Not applicable| None| Not applicable \nTdc.ocx| 10.0.9200.22387| 61,952| 20-Feb-2018| 18:51| x86| None| Not applicable \nDxtmsft.dll| 10.0.9200.22387| 359,936| 20-Feb-2018| 18:51| x86| None| Not applicable \nDxtrans.dll| 10.0.9200.22695| 228,352| 12-Feb-2019| 04:16| x86| None| Not applicable \nMsfeeds.dll| 10.0.9200.22885| 493,568| 28-Sep-2019| 06:15| x86| None| Not applicable \nMsfeeds.mof| Not applicable| 1,518| 20-Feb-2018| 16:01| Not applicable| None| Not applicable \nMshtmled.dll| 10.0.9200.22695| 80,384| 12-Feb-2019| 04:16| x86| None| Not applicable \nMshtml.dll| 10.0.9200.22885| 14,723,072| 28-Sep-2019| 06:15| x86| None| Not applicable \nMshtml.tlb| 10.0.9200.22387| 2,706,432| 20-Feb-2018| 17:33| Not applicable| None| Not applicable \nWow64_microsoft-windows-ie-htmlrendering.ptxml| Not applicable| 3,228| 20-Feb-2018| 16:00| Not applicable| None| Not applicable \nIernonce.dll| 10.0.9200.22387| 33,280| 20-Feb-2018| 18:51| x86| None| Not applicable \nIesetup.dll| 10.0.9200.22387| 61,440| 20-Feb-2018| 18:51| x86| None| Not applicable \nIe9props.propdesc| Not applicable| 2,843| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nIeframe.dll| 10.0.9200.22885| 13,783,552| 28-Sep-2019| 06:15| x86| None| Not applicable \nWow64_ieframe.ptxml| Not applicable| 25,923| 20-Feb-2018| 16:00| Not applicable| None| Not applicable \nJscript9.dll| 10.0.9200.22885| 2,757,632| 28-Sep-2019| 06:15| x86| None| Not applicable \nJscript.dll| 5.8.9200.22885| 705,536| 28-Sep-2019| 06:15| x86| None| Not applicable \nVbscript.dll| 5.8.9200.22885| 514,560| 28-Sep-2019| 06:15| x86| None| Not applicable \nAuthbroker.dll| 6.2.9200.22671| 74,752| 24-Jan-2019| 04:33| x86| None| Not applicable \nUxtheme.dll| 6.2.9200.22387| 534,528| 20-Feb-2018| 16:52| x86| None| Not applicable \nWwaapi.dll| 6.2.9200.22695| 75,264| 12-Feb-2019| 04:16| x86| None| Not applicable \nWow64_windowswebapphost.ptxml| Not applicable| 2,055| 20-Sep-2012| 01:45| Not applicable| None| Not applicable \nWwahost.exe| 6.2.9200.22858| 334,848| 27-Aug-2019| 09:19| x86| None| Not applicable \nWindowslivelogin.dll| 6.2.9200.22671| 233,472| 24-Jan-2019| 04:34| x86| None| Not applicable \nWindows.ui.xaml.dll| 6.2.9200.22671| 10,803,200| 24-Jan-2019| 04:34| x86| None| Not applicable \nHlink.dll| 6.2.9200.22522| 75,264| 19-Jul-2018| 17:49| x86| None| Not applicable \nUrlmon.dll| 10.0.9200.22885| 1,170,944| 28-Sep-2019| 06:15| x86| None| Not applicable \nInetcpl.cpl| 10.0.9200.22722| 1,441,280| 26-Mar-2019| 03:14| Not applicable| None| Not applicable \nJsproxy.dll| 10.0.9200.22387| 38,400| 20-Feb-2018| 18:51| x86| None| Not applicable \nWininet.dll| 10.0.9200.22885| 1,768,448| 28-Sep-2019| 06:15| x86| None| Not applicable \nIdctrls.dll| 6.2.9200.22671| 63,488| 24-Jan-2019| 04:33| x86| None| Not applicable \nIedkcs32.dll| 18.0.9200.22695| 226,816| 12-Feb-2019| 04:16| x86| None| Not applicable \nInstall.ins| Not applicable| 464| 28-Sep-2019| 03:21| Not applicable| None| Not applicable \nIeapfltr.dat| 10.0.8411.0| 1,400,416| 21-Nov-2017| 07:23| Not applicable| None| Not applicable \nIeapfltr.dll| 10.0.9200.22885| 629,248| 28-Sep-2019| 06:15| x86| None| Not applicable \nIelowutil.exe| 10.0.9200.22671| 222,208| 24-Jan-2019| 04:34| x86| None| Not applicable \nIeproxy.dll| 10.0.9200.22671| 258,048| 24-Jan-2019| 04:33| x86| None| Not applicable \nIeshims.dll| 10.0.9200.22387| 245,248| 20-Feb-2018| 18:51| x86| None| Not applicable \nIcrav03.rat| Not applicable| 8,798| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nMsrating.dll| 10.0.9200.22387| 163,840| 20-Feb-2018| 18:51| x86| None| Not applicable \nTicrf.rat| Not applicable| 1,988| 15-Nov-2017| 00:49| Not applicable| None| Not applicable \nIertutil.dll| 10.0.9200.22885| 2,091,008| 28-Sep-2019| 06:15| x86| None| Not applicable \nIesysprep.dll| 10.0.9200.22387| 109,056| 20-Feb-2018| 18:51| x86| SPR| X86_MICROSOFT-WINDOWS-IE-SYSP \nVgx.dll| 10.0.9200.22695| 818,688| 12-Feb-2019| 04:16| x86| None| Not applicable \nIeinstal.exe| 10.0.9200.22752| 478,720| 30-Apr-2019| 03:14| x86| None| Not applicable \nJsdebuggeride.dll| 10.0.9200.22387| 108,032| 20-Feb-2018| 18:51| x86| None| Not applicable \nInetcomm.dll| 6.2.9200.22885| 737,280| 28-Sep-2019| 06:15| x86| None| Not applicable \nInetres.dll| 6.2.9200.22387| 84,480| 20-Feb-2018| 17:32| x86| None| Not applicable \nPhotoviewer.dll| 6.2.9200.22858| 1,637,376| 27-Aug-2019| 09:19| x86| None| Not applicable \nWindows.applicationmodel.store.dll| 6.2.9200.22671| 143,872| 24-Jan-2019| 04:34| x86| None| Not applicable \nWindows.applicationmodel.store.testingframework.dll| 6.2.9200.22885| 124,928| 28-Sep-2019| 06:15| x86| None| Not applicable \nWsshared.dll| 6.2.9200.22885| 568,832| 28-Sep-2019| 06:15| x86| None| Not applicable \nUxinit.dll| 6.2.9200.22387| 44,032| 20-Feb-2018| 18:51| x86| None| Not