The Patch Report for November 2022
Channel: Zero Day Initiative
Date: 08/11/2022

#ThePatchReport #ZeroDayInitiative #0Day 
Welcome to the November 2022 edition of the Patch Report - our brief look into the latest security updates from Microsoft, Adobe, and beyond. This month, we focus on multiple 0-day exploits getting fixes - most notably the Exchange Server bugs we were expecting in October. Join Dustin Childs (our chief "Patch Wrangler") as he breaks down the release and points out where enterprises should focus their attention.

You can read the full patch blog at:
https://www.zerodayinitiative.com/blog/2022/11/8/the-november-2022-security-update-review

00:00 Introduction
00:26 No Adobe patches for November
01:37 0-day in Exchange Server
02:15 0-day in Scripting Languages
02:52 0-day in Mark of the Web
03:31 0-day in Print Spooler
04:06 0-day in CNG Key Isolation
05:05 Hardcoded path in Exchange
06:55 Additional steps beyond patching in Kerberos
08:37 Critical DoS in Hyper-V Server
09:28 SharePoint RCE
10:13 Additional steps beyond patching NetLogon
10:25 EoP in SysInternals Sysmon
11:20 Info disclosure in Business Central
11:53 Bypass in BitLocker 
13:03 Office Defense-in-Depth Advisory
13:39 Wrap-Up