Category Archives: Vulnerabilities

A true chance to make CVE a true community program

This is something I always say – we have too little global, horizontal, community initiatives in cybersecurity. Lots of private and commercial initiatives, but fewer community ones.

The CVE program, run by MITRE, is running out of funding from the US government.
This event can be a trigger to change this. This is a golden opportunity for a change for good for the industry.

This is a chance to change it to be a global program, not only US controlled, funded by governments from around the world, plus core monetary support from the cybersecurity vendors and services giants who make billions of dollars out of cybersecurity and rely on CVE data.

“U.S. Govt. Funding for MITRE’s CVE Ends April 16, Cybersecurity Community on Alert”
https://thehackernews.com/2025/04/us-govt-funding-for-mitres-cve-ends.html

Microsoft, you have a problem

Recently (some will say – for many years by now) Microsoft is being criticized for its Information Security capabilities, as that it is slow to do the move from on-premises products security to also, in addition, a cloud provider security, which is, in my opinion, even harder.

This is my recent incident about it:

I recently accepted an email from one of Microsoft’s sub domains.

I use a commercial cloud email security service to protect my email traffic, and this system stopped this email from entering because the sub domain did not have any SPF record, so my email security service stopped this email as a possible email impersonating to be from Microsoft).

This sub domain still doesn’t have an SPF record, as I write this.

It is not a big security issue, but I know that if I was in charge of this online asset and I had such an issue – I will be glad if someone would alert me about it, so I tried to find a way to report this to Microsoft, but I did not find any explicit content directing where to report online security issues, so I opened a case at MSRC (Microsoft Security Response Center)

I am aware it is not a vulnerability but a missing security measure that MS better fix and I had no better place to report this to MS.

This is the response I got as my report was set by the MSRC analyst to a status of “This closed as a non-MSRC case.” (the bold text was highlighted by me):


Hello,

Thank you for contacting the Microsoft Security Response Center (MSRC). We appreciate the time taken to submit this assessment.

Upon investigation we have determined that this does not meet the definition of a security vulnerability.

The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.

As such, this thread is being closed and no longer monitored. We apologize for any inconvenience this may have caused.

If you believe this to be a misunderstanding of the report, submit a new report at https://aka.ms/secure-at

Please include:

Relevant information previously provided in your initial report
Detailed steps required to consistently reproduce the issue
Short explanation on how an attacker could use the information to exploit another user remotely
Proof-of-concept (POC), such as a video recording, crash reports, screenshots, or relevant code samples

For more information on what qualifies as a security vulnerability please see the following:
Definition of a Security Vulnerability: https://www.microsoft.com/msrc/definition-of-a-security-vulnerability

We thank you again for taking the time to submit this report!

Regards,

<name of the analyst>
MSRC

This is sad for at least two reasons:

  1. The core claim of the analyst is simply not true, technically – ” The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.”.
    MX record is for accepting emails. It can be absent and still it is possible to send emails from the relevant sub domain. Email sending and receiving works independently of each other.
    Hence, the core claim to block my report was based on mistaken or unknowledgeable information.
  2. I know it is not a vulnerability, but I guess MS should be happy to get any information that let it know it is missing a basic security measure, even if it is regarding an online attribute of it, not of a software product vulnerability

If Microsoft put at its MSRC frontline an analyst with such level of understanding how email works – then Microsoft really, really, have a problem.

And no, I will not open a new case at MSRC to prove them wrong. I will just go on with my life and Microsoft will need to live with the consequences of how it operates.

I will not make the extra mile effort when MS doesn’t even do the basics.

Possibly a new scam email using a vulnerability finding / bug bounty theme

This one is new. I found only two other mentions of similar things, at Reddit.
It looks like an introductory email towards some kind of possible scam, related to vulnerability finding / bug bounty.
It was sent to the privacy email of this blog.

Subject:
Uncovering Security Vulnerabilities in Your Application

From:
Robert Davis <[email protected]>

Body:
Hello,

I trust you’re well.

I’ve identified potential security issues in your application, aiming to ensure user safety. These vulnerabilities could impact functionality and compromise user security. I’d appreciate a suitable channel to share more details, facilitating a prompt review and resolution by your team.

If you have a Bug Bounty program, kindly provide information. If not, consider my commitment to enhancing digital platform security.

Looking forward to your response.

Best Regards,

Robert Davis