Microsoft Csharp Software Development Kit vulnerabilities

2 CVEs affecting Microsoft Csharp Software Development Kit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-8531, published 2018-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-8531, published 2018-10-10. High severity, CVSS 8.8. EPSS: 15.1% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Device Client SDK Memory Corruption…
CVE-2018-8119, published 2018-05-09. Medium severity, CVSS 5.6. EPSS: 1.2% chance of exploitation in the next 30 days. A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability."…