Remove Authentication Remove LAN Remove System
article thumbnail

Microsoft’s May 2025 Patch Tuesday Addresses 71 CVEs (CVE-2025-32701, CVE-2025-32706, CVE-2025-30400)

Tenable

Important CVE-2025-30385, CVE-2025-32701 and CVE-2025-32706 | Windows Common Log File System Driver Elevation of Privilege Vulnerabilities CVE-2025-30385 , CVE-2025-32701 and CVE-2025-32706 are EoP vulnerabilities in the Windows Common Log File System (CLFS) Driver. Each was assigned a CVSSv3 score of 7.8 and are rated as important.

Windows 101
article thumbnail

Microsoft’s February 2025 Patch Tuesday Addresses 55 CVEs (CVE-2025-21418, CVE-2025-21391)

Tenable

A local, authenticated attacker could exploit this vulnerability to elevate to SYSTEM level privileges. A local, authenticated attacker could exploit this vulnerability to delete files from a system. Exploitation would allow an attacker to obtain a user's NTLMv2 hash, which could then be used to authenticate as that user.

Windows 74
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Microsoft’s September 2023 Patch Tuesday Addresses 61 CVEs (CVE-2023-36761)

Tenable

Successful exploitation of this flaw would allow for the disclosure of New Technology LAN Manager (NTLM) hashes. Exploitation of this flaw would grant an attacker SYSTEM privileges. Successful exploitation of these vulnerabilities requires an attacker to authenticate with LAN-access and have valid credentials for an Exchange user.

LAN 128
article thumbnail

Hybrid working: network managers need to take care of unfinished business

CIO

How are those users accessing their systems? If employees are not able to access key business systems no matter where they are, you have an issue. NTT’s recipe for hybrid working begins with zero trust network architecture, identity management and multifactor authentication. Are they performing to standard?

Network 156
article thumbnail

Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)

Tenable

Successful exploitation of this flaw would allow an attacker to relay a New Technology LAN Manager Version 2 (NTLMv2) hash against a vulnerable server. In order to exploit this flaw, an attacker would need to be authenticated with LAN-access and have a valid login for an Exchange user. for CVE-2024-21345 to 7.0

LAN 133
article thumbnail

CVE-2020-1472: 'Zerologon' Vulnerability in Netlogon Could Allow Attackers to Hijack Windows Domain Controller

Tenable

Security researchers reveal how the cryptographic authentication scheme in Netlogon can be exploited to take control of a Windows domain controller (DC). An attacker can exploit this flaw to impersonate the identity of any machine on a network when attempting to authenticate to the Domain Controller (DC). Identifying affected systems.

Windows 122
article thumbnail

CVE-2020-27125, CVE-2020-27130, CVE-2020-27131: Pre-Authentication Vulnerabilities in Cisco Security Manager Disclosed

Tenable

As part of his PoC release for CVE-2020-27131, Hauser included a reference to TRA-2017-23 , a vulnerability disclosure from Tenable’s Zero Day Research team from 2017 regarding a deserialization remote code execution vulnerability in Cisco Security Manager and Cisco Prime LAN Management Solution. Identifying affected systems.