Microsoft C Software Development Kit vulnerabilities

2 CVEs affecting Microsoft C Software Development Kit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-8479, published 2018-09-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-8479, published 2018-09-13. Medium severity, CVSS 5.6. EPSS: 2.1% chance of exploitation in the next 30 days. A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK.
• CVE-2018-8119, published 2018-05-09. Medium severity, CVSS 5.6. EPSS: 1.2% chance of exploitation in the next 30 days. A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability."…