Microsoft Patch Tuesday, November 2019: the CVEs

Microsoft Patch Tuesday November 2019: the CVEs Microsoft published on 12 November 2019, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Oct 2019, Sep 2019, Aug 2019, Jul 2019, Jun 2019, May 2019, Apr 2019, Mar 2019, Feb 2019, Jan 2019, Dec 2018, Nov 2018. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 9.8CVE-2019-1449EPSS 6.8%2019-11-12

   A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate …

2. 9.9CVE-2019-1384EPSS 7.0%2019-11-12

   A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Wi…

3. 9.8CVE-2019-1373EPSS 22%2019-11-12

   A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

4. 9.1CVE-2019-0721EPSS 12%2019-11-12

   A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V Remote Code Execution Vulnerability'. T…

5. 9.1CVE-2019-0719EPSS 11%2019-11-12

   A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V Remote Code Execution Vulnerability'. T…