Edge type confusion RCE headlines a five-bug Saturday mix

A type confusion bug in the Chromium engine used by Microsoft Edge lets an attacker run arbitrary code on your machine over the network. This typically means a malicious or compromised website can take control of the browser process. No special privileges are needed on the attacker's side, just luring a user to a page.

Affected estate

Anyone running Microsoft Edge (Chromium-based), including enterprise-managed desktops and kiosk systems

How to check

Open edge://settings/help to see the current version, or query installed Edge versions via your endpoint management tool (Intune, SCCM, etc.).

Included because

network-exploitable; no authentication needed; common product on nearly every enterprise desktop; CVSS 8.8

Action

Push the latest Edge update across your fleet immediately.

Why it matters

An attacker can execute code on any endpoint where a user visits a malicious page, no other interaction required.

Source

Microsoft Security Advisory

Any team member in HyperDX (through 1.10.1) can perform admin-only actions: deleting other team members (including owners), rotating API keys, and renaming teams. There's no privilege check on the team management API endpoints. A disgruntled or compromised low-privilege account can lock everyone else out and kill your API integrations.

Affected estate

Anyone self-hosting HyperDX through version 1.10.1

How to check

Check your HyperDX version in the application settings or container image tag.

Included because

broken access control; authenticated but no privilege required; API keys at risk; CVSS 8.1

Action

Upgrade HyperDX past 1.10.1, or restrict API access to the team management endpoints at the network level as a stopgap.

Why it matters

Any authenticated team member can delete owners, rotate API keys, and effectively take over or sabotage your observability platform.

Source

HyperDX project disclosure

The MongoDB Connector for BI (mongosqld) puts MongoDB object names like collection and field names directly into SQL DDL output without escaping quote delimiters. If an attacker has write access to a sampled MongoDB collection, they can craft a name that injects arbitrary SQL into the generated DDL. The injection fires if you or an automated tool later executes that generated SQL against a downstream SQL server. This is a two-step attack: the attacker needs MongoDB write access first, then the injected SQL runs with whatever privileges the downstream session has.

Affected estate

Anyone using MongoDB Connector for BI (mongosqld) where users can write to sampled collections, especially if generated DDL is replayed automatically against a SQL database

How to check

Run 'mongosqld --version' to confirm your installed version. Review whether any automation replays DDL output against a SQL server.

Included because

SQL injection via crafted names; requires MongoDB write access but downstream impact is high; CVSS 8.0

Action

Upgrade MongoDB Connector for BI to the latest patched release and audit automated DDL replay pipelines.

Why it matters

An attacker with MongoDB write access can inject SQL that executes with full privileges on your downstream SQL server.

Source

MongoDB vendor advisory

BOSH Director's vCenter CPI doesn't properly validate vCenter's TLS certificate. An attacker positioned between BOSH Director and vCenter can impersonate the vCenter REST API and capture vCenter admin credentials sent via HTTP Basic auth. Since those credentials typically have full control over your entire virtualization stack, successful interception gives the attacker access to every VM, datastore, and network managed by that vCenter. This exposure happens on every CPI call, not just during specific operations, and supplying a CA certificate alone doesn't fix it.

Affected estate

Anyone running BOSH Director with the vCenter CPI, particularly Cloud Foundry operators whose BOSH Director communicates with vCenter over a network segment that isn't fully trusted

How to check

Check your BOSH Director CPI version with 'bosh deployments' and review the vCenter CPI release in your deployment manifest.

Included because

credential theft via MITM; no authentication barrier for positioned attacker; full infrastructure takeover potential; CVSS 7.7; every CPI call is exposed

Action

Upgrade the vCenter CPI to the patched release, then rotate all vCenter credentials used by BOSH Director.

Why it matters

A network-positioned attacker can steal vCenter admin credentials on every routine BOSH operation, gaining full control of your entire virtualization infrastructure.

Source

BOSH / Cloud Foundry vendor advisory