IIS
Monthly
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configuration secrets and account password hashes - when the site is served by Microsoft IIS using the bundled webserver-configs/web.config over a case-insensitive filesystem such as NTFS, simply by varying the case of a folder name or extension (for example GET /user/CONFIG/system.YAML) so that none of the case-sensitive URL Rewrite deny rules match. The practical blast radius is narrower than the raw path-bypass suggests: whether a bypassed file is actually returned depends on MIME registration, with .json served by default while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added; the equivalent gap in webserver-configs/lighttpd.conf is lower risk because lighttpd typically runs on case-sensitive filesystems, and deployments behind Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. No public exploit identified at time of analysis, and while the vendor-released patch is Grav 2.0.25, upgrading alone is insufficient because the .htaccess installer heal does not rewrite web.config or lighttpd.conf, so operators must manually re-copy the corrected sample files.
Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks and cookie forgery.
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs enabling deserialization attacks. EPSS 0.17%.
Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system. [CVSS 7.8 HIGH]
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configuration secrets and account password hashes - when the site is served by Microsoft IIS using the bundled webserver-configs/web.config over a case-insensitive filesystem such as NTFS, simply by varying the case of a folder name or extension (for example GET /user/CONFIG/system.YAML) so that none of the case-sensitive URL Rewrite deny rules match. The practical blast radius is narrower than the raw path-bypass suggests: whether a bypassed file is actually returned depends on MIME registration, with .json served by default while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added; the equivalent gap in webserver-configs/lighttpd.conf is lower risk because lighttpd typically runs on case-sensitive filesystems, and deployments behind Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. No public exploit identified at time of analysis, and while the vendor-released patch is Grav 2.0.25, upgrading alone is insufficient because the .htaccess installer heal does not rewrite web.config or lighttpd.conf, so operators must manually re-copy the corrected sample files.
Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks and cookie forgery.
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs enabling deserialization attacks. EPSS 0.17%.
Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system. [CVSS 7.8 HIGH]