3 ms·
> Despite Microsoft acknowledging the reports, its security engineers decided the flaws weren't severe enough to guarantee immediate servicing, postponing the f
by gustavus 3y ago
> Despite Microsoft acknowledging the reports, its security engineers decided the flaws weren't severe enough to guarantee immediate servicing, postponing the fixes for later.
Well that is an egregious display of bullhockey and an almost criminal level of negligence. RCE is basically a game over level exploit.
- djbusby 3y agoIf you don't ship on time it could affect your bonus. Gotta prioritize.
- steve1977 3y ago“All these vulnerabilities require authentication for exploitation, which reduces their severity CVSS rating to between 7.1 and 7.5. Furthermore, requiring authentication is a mitigation factor and possibly why Microsoft did not prioritize the fixing of the bugs.”
- kenjackson 3y agoNot all RCEs are created equal. As noted, post-auth has a diffeeent bar than no-auth.