Week of April 8, 2024

A vulnerability in Windows Secure Boot allows attackers with administrative privileges to bypass Secure Boot protections and install persistent bootkits or rootkits. The flaw stems from improper validation of bootloaders, enabling malicious EFI binaries to load despite Secure Boot being enabled. Microsoft released patches and updated blocklists in March 2024 to address the issue.

A remote code execution vulnerability was disclosed in Microsoft Defender for IoT. The flaw could allow an attacker to execute arbitrary code on affected systems. No further technical details or exploitation status were provided in the article.

CVE-2024-2224 is a critical path traversal vulnerability in the UpdateServer component of Bitdefender GravityZone. It allows remote unauthenticated attackers to execute arbitrary code on affected endpoint security products and the on-premises management console. The flaw stems from insufficient validation of file path inputs, enabling attackers to write malicious files outside restricted directories.