Security
Headlines
HeadlinesLatestCVEs

Tag

#microsoft

CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

**According to the CVSS metric, successful exploitation of this vulnerability has a high impact on availability (A:H). What does that mean for this vulnerability?** An attacker can send specially crafted messages to the MSMQ service, which could affect availability of the service and result in Denial of Service (DoS).

Microsoft Security Response Center
#vulnerability#microsoft#dos#Windows Message Queuing#Security Vulnerability
CVE-2025-21198: Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

**According to the CVSS metric, the attack vector is adjacent (AV:A) and privileges required are low (PR:L). What does that mean for this vulnerability?** Multiple networking topologies are available to connect High Performance Compute (HPC) resources which are reliant upon intra-nets or private networks and do not expose HPC resources to the public internet regardless of implementation. An attacker must have access to the network connecting the targeted clusters and nodes (PR:L) and must send a specially crafted HTTPS request to the head node (AV:A) to successfully exploit this vulnerability. For more information on how HPC resources can be connected, please reference this documentation regarding Understanding HPC Cluster Network Topologies.

CVE-2025-21381: Microsoft Excel Remote Code Execution Vulnerability

**According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?** The word **Remote** in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the **Attack Vector** is **Local** and **User Interaction** is **Required**, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

CVE-2025-21322: Microsoft PC Manager Elevation of Privilege Vulnerability

**What privileges could be gained by an attacker who successfully exploited this vulnerability?** An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Handala Hackers Claim Massive Data Breach on Israeli Police, Leak 350,000 Files

Iranian-linked hackers claim to have breached Israeli police systems, stealing 2.1TB of sensitive data. Police deny the breach. Learn more about the alleged hack and its implications.

UK Secret Order Demands That Apple Give Access to Users’ Encrypted Data

Plus: Benjamin Netanyahu gives Donald Trump a golden pager, Hewlett Packard Enterprise blames Russian government hackers for a breach, and more.

ASP.NET Vulnerability Lets Hackers Hijack Servers, Inject Malicious Code

Microsoft cybersecurity experts have identified a vulnerability flaw affecting ASP.NET applications, putting thousands of web servers at risk.…

Microsoft: Thousands of Public ASP.NET Keys Allow Web Server RCE

Developers are pulling in publicly available ASP.NET keys into their environments, without realizing that cyberattackers can use them for clandestine code injection.

Google's DMARC Push Pays Off, but Email Security Challenges Remain

A year after Google and Yahoo started requiring DMARC, the adoption rate of the email authentication specification has doubled; and yet, 87% of domains remain unprotected.