Symantec product detections for Microsoft monthly Security Bulletins - March 2018

Products

• Endpoint Protection

Issue/Introduction

This document describes Symantec product detections for the Microsoft vulnerabilities for which Microsoft releases patches in their monthly Security Bulletins.

Note: Symantec posts this information shortly after it becomes available from Microsoft. Any missing information will be added to the document as it becomes available.
Note: These have been referred to previously as Security Advisories. The language has been updated to Security Bulletins to maintain cadence with Microsoft's terminology
Note: The fields for KB and Bulletin are no longer populated or used by Microsoft, and they no longer appear here as of April 2017 

Resolution

 

ID and Rating	CAN/CVE ID: ADV180006 BID: N/A Microsoft Rating: Critical
Vulnerability Type	March 2018 Adobe Flash Security Update
Vulnerability Affects	See Adobe.com for details
Details	See Adobe.com for details
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0872 BID: 103267 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0872 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0874 BID: 103269 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0874 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0876 BID: 103289 Microsoft Rating: Critical
Vulnerability Type	Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0889 BID: 103295 Microsoft Rating: Critical
Vulnerability Type	Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10 Microsoft Internet Explorer 11
Details	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0889 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0893 BID: 103288 Microsoft Rating: Critical
Vulnerability Type	Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Web Attack: CVE-2018-0893 Remote Memory Corruption Vulnerability
Other Detections	AV: Exp.CVE-2018-0893 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0925 BID: 103287 Microsoft Rating: Critical
Vulnerability Type	Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore
Details	A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0930 BID: 103272 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Exp.CVE-2018-0930
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0931 BID: 103273 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0932 BID: 103307 Microsoft Rating: Critical
Vulnerability Type	Microsoft Browser Information Disclosure Vulnerability Information Disclosure
Vulnerability Affects	Microsoft Internet Explorer 11 Microsoft Edge
Details	An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0933 BID: 103274 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0933 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0934 BID: 103275 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0934 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0936 BID: 103270 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0937 BID: 103271 Microsoft Rating: Critical
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0939 BID: 103305 Microsoft Rating: Critical
Vulnerability Type	Scripting Engine Information Disclosure Vulnerability Information Disclosure
Vulnerability Affects	Microsoft Edge Microsoft ChakraCore
Details	An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0947 BID: 103306 Microsoft Rating: Critical
Vulnerability Type	Microsoft Sharepoint Elevation of Privilege Vulnerability Elevation of Privilege
Vulnerability Affects	Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 SP1
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly verify tenant permissions. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0787 BID: 103282 Microsoft Rating: Important
Vulnerability Type	ASP.NET Core Elevation of Privilege Vulnerability Elevation of Privilege
Vulnerability Affects	Microsoft ASP.NET Microsoft ASP.NET Core 2.0 Microsoft Windows 10 version 1703 for 32-bit Systems
Details	A privilege escalation vulnerability exists when a Kestrel web application fails to validate web requests. An attacker who successfully exploited this vulnerability could perform HTML injection attacks.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0808 BID: 103226 Microsoft Rating: Important
Vulnerability Type	ASP.NET Core Denial of Service Vulnerability
Vulnerability Affects	Microsoft ASP.NET Core 2.0
Details	A denial of service vulnerability exists when ASP. NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0811 BID: 103232 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0813 BID: 103250 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0814 BID: 103251 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0815 BID: 103234 Microsoft Rating: Important
Vulnerability Type	Windows GDI Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for x64-based Systems SP1
Details	A privilege escalation vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0816 BID: 103248 Microsoft Rating: Important
Vulnerability Type	Windows GDI Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2
Details	A privilege escalation vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0817 BID: 103249 Microsoft Rating: Important
Vulnerability Type	Windows GDI Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016
Details	A privilege escalation vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0817 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0868 BID: 103236 Microsoft Rating: Important
Vulnerability Type	Windows Installer Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016
Details	A privilege escalation vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0873 BID: 103268 Microsoft Rating: Important
Vulnerability Type	Chakra Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft ChakraCore Microsoft Edge
Details	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0875 BID: 103225 Microsoft Rating: Important
Vulnerability Type	.NET Core Denial of Service Vulnerability
Vulnerability Affects	Microsoft ASP.NET Core 1.0 Microsoft ASP.NET Core 1.1 Microsoft ASP.NET Core 2.0
Details	A denial of service vulnerability exists in the way that ASP. NET Core handles specially crafted requests, causing a hash collision.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0877 BID: 103227 Microsoft Rating: Important
Vulnerability Type	Windows Desktop Bridge VFS Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016
Details	A privilege escalation vulnerability exists in Windows when the Desktop Bridge VFS does not take into acccount user/kernel mode when managing file paths. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0877 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0878 BID: 103230 Microsoft Rating: Important
Vulnerability Type	Windows Remote Assistance Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows Server 2008 R2 for x64-based Systems SP1
Details	An information disclosure vulnerability exists when Windows Remote Assistance incorrectly processes XML External Entities (XXE).
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0879 BID: 103303 Microsoft Rating: Important
Vulnerability Type	Microsoft Edge Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Edge
Details	An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0880 BID: 103239 Microsoft Rating: Important
Vulnerability Type	Windows Desktop Bridge Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems
Details	A privilege escalation vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: Web Attack: CVE-2018-0880 Local Privilege Escalation Vulnerability
Other Detections	AV: Exp.CVE-2018-0880 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0881 BID: 103256 Microsoft Rating: Important
Vulnerability Type	Microsoft Video Control Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016 Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2
Details	A privilege escalation vulnerability exists in Windows when the Microsoft Video Control mishandles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in system mode.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0882 BID: 103257 Microsoft Rating: Important
Vulnerability Type	Windows Desktop Bridge Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016
Details	A privilege escalation vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0882 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0883 BID: 103259 Microsoft Rating: Important
Vulnerability Type	Windows Shell Remote Code Execution Vulnerability
Vulnerability Affects	Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows Server 2012 R2 Microsoft Windows RT 8.1 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2016 Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
Details	A remote code execution vulnerability exists when Windows Shell does not properly validate file copy destinations. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Under Analysis Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0884 BID: 103260 Microsoft Rating: Important
Vulnerability Type	Windows Security Feature Bypass Vulnerability
Vulnerability Affects	Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems
Details	A security bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0885 BID: 103261 Microsoft Rating: Important
Vulnerability Type	Windows Hyper-V Denial of Service Vulnerability
Vulnerability Affects	Microsoft Hyper-V Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems
Details	A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0886 BID: 103265 Microsoft Rating: Important
Vulnerability Type	CredSSP Remote Code Execution Vulnerability
Vulnerability Affects	Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows Server 2012 R2 Microsoft Windows RT 8.1 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2016 Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 10 version 1709 for x64-based Systems
Details	A remote code execution vulnerability exists in the Credential Security Support Provider protocol (CredSSP).
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0888 BID: 103262 Microsoft Rating: Important
Vulnerability Type	Hyper-V Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Hyper-V Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows 8.1 for x64-based Systems Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2012 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2016 Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1
Details	An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0891 BID: 103309 Microsoft Rating: Important
Vulnerability Type	Scripting Engine Information Disclosure Vulnerability
Vulnerability Affects
Details
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0894 BID: 103231 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft ChakraCore Microsoft Internet Explorer 11 Microsoft Edge
Details	An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0895 BID: 103238 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0896 BID: 103240 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects
Details
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0897 BID: 103241 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0898 BID: 103242 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0899 BID: 103243 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: N/A Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0900 BID: 103244 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0901 BID: 103245 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0902 BID: 103266 Microsoft Rating: Important
Vulnerability Type	CNG Security Feature Bypass Vulnerability
Vulnerability Affects	Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows Server 2016
Details	A security bypass vulnerability exists in the Cryptography Next Generation (CNG) kernel-mode driver (cng. sys) when it fails to properly validate and enforce impersonation levels.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0903 BID: 103315 Microsoft Rating: Important
Vulnerability Type	Microsoft Access Remote Code Execution Vulnerability
Vulnerability Affects	Microsoft Access 2010 SP2 (32-bit editions) Microsoft Access 2010 SP2 (64-bit editions) Microsoft Access 2013 Service Pack 1 (32-bit editions) Microsoft Access 2013 Service Pack 1 (64-bit editions) Microsoft Access 2016 (32-bit edition) Microsoft Access 2016 (64-bit edition) Microsoft Office 2016 Click-to-Run (C2R) for 32-bit edition Microsoft Office 2016 Click-to-Run (C2R) for 64-bit edition
Details	A remote code execution vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0903 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0904 BID: 103246 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows Server 2016 Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 for x64-based Systems Microsoft Windows 10 for 32-bit Systems Microsoft Windows RT 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 for x64-based Systems Microsoft Windows 8.1 for 32-bit Systems Microsoft Windows Server 2012
Details	An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. An attacker who successfully exploited the vulnerability could retrieve the memory address of a kernel object.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0907 BID: 103325 Microsoft Rating: Important
Vulnerability Type	Microsoft Office Excel Security Feature Bypass
Vulnerability Affects	Microsoft Excel 2007 SP3 Microsoft Excel 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2010 Service Pack 2 (64-bit editions) Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Excel 2013 RT Service Pack 1 Microsoft Excel 2016 (32-bit editions) Microsoft Excel 2016 (64-bit editions) Microsoft Excel 2016 for Mac Microsoft Office 2016 Click-to-Run (C2R) for 32-bit edition Microsoft Office 2016 Click-to-Run (C2R) for 64-bit edition
Details	A security bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document. The Security Bypass by itself does not allow arbitrary code execution.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0909 BID: 103279 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0910 BID: 103280 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0911 BID: 103281 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0912 BID: 103285 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0913 BID: 103290 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0914 BID: 103291 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0915 BID: 103293 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0916 BID: 103294 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0917 BID: 103296 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0919 BID: 103311 Microsoft Rating: Important
Vulnerability Type	Microsoft Office Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Office 2016 Click-to-Run (C2R) for 64-bit edition Microsoft Office 2016 Click-to-Run (C2R) for 32-bit edition Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2016 for Mac Microsoft Office Online Server 2016 Microsoft Office Web Apps 2010 SP2 Microsoft Office Web Apps Server 2013 SP1 Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server 2010 SP2 Microsoft Word 2010 Service Pack 2 (32-bit editions) Microsoft Word 2010 Service Pack 2 (64-bit editions) Microsoft Word 2013 RT Service Pack 1 Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Word 2016 (32-bit edition) Microsoft Word 2016 (64-bit edition)
Details	An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory. An attacker who successfully exploited the vulnerability could view out of bound memory.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0921 BID: 103302 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0922 BID: 103314 Microsoft Rating: Important
Vulnerability Type	Microsoft Office Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft Office Compatibility Pack Service Pack 3 Microsoft Office Online Server 2016 Microsoft Office Web Apps 2010 SP2 Microsoft Office Web Apps 2013 SP1 Microsoft Office Word Viewer Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft SharePoint Server 2010 SP2 Microsoft Word 2007 Service Pack 3 Microsoft Word 2010 Service Pack 2 (32-bit editions) Microsoft Word 2010 Service Pack 2 (64-bit editions) Microsoft Word 2013 (32-bit editions) Microsoft Word 2013 (64-bit editions) Microsoft Word 2013 RT Service Pack 1
Details	A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0922 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0923 BID: 103308 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0926 BID: 103247 Microsoft Rating: Important
Vulnerability Type	Windows Kernel Information Disclosure Vulnerability
Vulnerability Affects	Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0927 BID: 103310 Microsoft Rating: Important
Vulnerability Type	Microsoft Browser Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Internet Explorer 11 Microsoft Edge Microsoft Internet Explorer 10
Details	An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0929 BID: 103299 Microsoft Rating: Important
Vulnerability Type	Internet Explorer Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Internet Explorer 11 Microsoft Internet Explorer 10 Microsoft Internet Explorer 9
Details	An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker can exploit this issue to obtain sensitive information to further compromise the user’s system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0935 BID: 103298 Microsoft Rating: Important
Vulnerability Type	Scripting Engine Memory Corruption Vulnerability Remote Code Execution
Vulnerability Affects	Microsoft Internet Explorer 9 Microsoft Internet Explorer 10 Microsoft Internet Explorer 11
Details	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Intrusion Protection System (IPS) Response	Sig ID: N/A
Other Detections	AV: Exp.CVE-2018-0935 Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0941 BID: 103318 Microsoft Rating: Important
Vulnerability Type	Microsoft Exchange Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Exchange Server 2016 Cumulative Update 7 Microsoft Exchange Server 2016 Cumulative Update 8
Details	An information disclosure vulnerability exists in the way that Microsoft Exchange Server handles importing data. If an impacted user is using Microsoft Exchange Outlook Web Access (OWA).
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0942 BID: 103312 Microsoft Rating: Important
Vulnerability Type	Internet Explorer Elevation of Privilege Vulnerability Security Feature Bypass
Vulnerability Affects	Microsoft Internet Explorer 11
Details	A privilege escalation vulnerability exists when Internet Explorer fails a check, allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0944 BID: 103304 Microsoft Rating: Important
Vulnerability Type	Microsoft SharePoint Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Project Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016
Details	A privilege escalation vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. affected SharePoint server.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0977 BID: 103380 Microsoft Rating: Important
Vulnerability Type	Win32k Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 for 32-bit  SystemsMicrosoft Windows 10 for x64-based Systems Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows Server 2016
Details	An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0983 BID: 103381 Microsoft Rating: Important
Vulnerability Type	Windows Storage Services Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Windows 10 version 1511 for 32-bit Systems Microsoft Windows 10 version 1511 for x64-based Systems Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Windows Server 2016 for x64-based Systems Microsoft Windows 10 version 1703 for 32-bit Systems Microsoft Windows 10 version 1703 for x64-based Systems Microsoft Windows 10 version 1709 for 32-bit Systems Microsoft Windows 10 version 1709 for x64-based Systems Microsoft Windows Server 2016
Details	An elevation of privilege vulnerability exists when Storage Services improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0924 BID: 103320 Microsoft Rating: Low
Vulnerability Type	Microsoft Exchange Information Disclosure Vulnerability
Vulnerability Affects	Microsoft Exchange Server 2016 Cumulative Update 7 Microsoft Exchange Server 2016 Cumulative Update 8 Microsoft Exchange Server 2010 SP3 Update Rollup 20 Microsoft Exchange Server 2013 Cumulative Update 18 Microsoft Exchange Server 2013 SP1 Microsoft Exchange Server 2013 Cumulative Update 19
Details	An information disclosure vulnerability exists in the way that Microsoft Exchange Server handles URL redirects. If an impacted user is using Microsoft Exchange Outlook Web Access (OWA) Light.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security:

 

ID and Rating	CAN/CVE ID: CVE-2018-0940 BID: 103323 Microsoft Rating: Moderate
Vulnerability Type	Microsoft Exchange Elevation of Privilege Vulnerability
Vulnerability Affects	Microsoft Exchange Server 2010 SP3 Update Rollup 20 Microsoft Exchange Server 2013 Cumulative Update 18 Microsoft Exchange Server 2013 Cumulative Update 19 Microsoft Exchange Server 2013 SP1 Microsoft Exchange Server 2016 Cumulative Update 7 Microsoft Exchange Server 2016 Cumulative Update 8
Details	A privilege escalation vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly sanitize links presented to users.
Intrusion Protection System (IPS) Response	Sig ID: Under review
Other Detections	AV: Under review Data Center Security: