It's been a busy start to the new year as bug hunters and security teams have scrambled to patch a series of critical flaws and vulnerabilities.

This has been particularly bad for Microsoft, which announced this week that a misconfiguration had left the company's internal customer support database exposed. According to Comparitech, which discovered the misconfiguration, more than 250 million records from customers around the world had been exposed.

While most personally identifiable information, including email addresses, contact numbers, and payment information was redacted, some data including some customer email addresses — that, according to Microsoft, were not redacted due a formatting issue — along with IP addresses, locations, claim descriptions and emails, and internal notes marked "confidential" were exposed.

Microsoft said it is not aware of any malicious use of the data since the incident was reported.

Cisco Releases Another Batch of Bug Patches

Microsoft isn't alone. Cisco this week rolled another set of patches across its product line. Since Wednesday, Cisco has released a total of 27 bug patches, including one "critical" and seven "high" priority bug patches.

These fixes address vulnerabilities affecting the company's Firepower Management Center, TelePresence, Smart Software Manager, and IOS XR products, which could have allowed remote access to unauthenticated users.

Cisco's SD-WAN product also received high priority patches to prevent unauthorized access, however, the company notes the product was not vulnerable to remote attacks.

Cisco has released software updates that address these vulnerabilities.

A Very Bad, Not Good Start to the Year

In the past three weeks, Microsoft, Cisco, Oracle, and Citrix have announced a slew of vulnerabilities as the companies attempt to lock down their product lines. And while most of these vulnerabilities have been patched with haste, some remain unresolved — more than a month after their initial discovery.

Microsoft's database leak comes just a few weeks after the company patched an exceptionally serious vulnerability, discovered by the National Security Agency, that could have allowed an attacker to defeat trusted network connections and deliver malicious code. Worse, Microsoft notes that “the user would have no way of knowing the file was malicious because the digital signature would appear to be from a trusted provider.”

Microsoft claims the bug has not been exploited.

Cisco’s Buggy Start to 2020

Similarly, Cisco had barely finished ringing in the new year when it was forced to roll out another set of "critical" security updates for its troubled Data Center Manager (DCNM), which has a history of security flaws.

The patches address a flaw in the authentication mechanism of Cisco's DCNM that could have allowed an unauthorized, remote attacker to bypass authentication and execute actions or privileges on a device. The vulnerability reportedly affects DCNM releases earlier than version 11.3(1) for Microsoft Windows, Linux, and Virtual appliance platforms.

The vulnerabilities were initially discovered by Steven Seeley of Source Incite, who was working with Trend Micro’s Zero Day Initiative. Cisco has since patched these vulnerabilities.

Oracle Breaks Bug-Fix Record

Oracle couldn't escape the security bug either. The company kicked off 2020 by setting a new record, and not the kind any company wants to be setting. The company patched 334 vulnerabilities across 90 products, its largest patch announcement in recent history.

According to Oracle, some of these vulnerabilities may have been successfully exploited prior to the patch release, however, a spokesperson declined to elaborate further.

Dozens of the vulnerabilities listed in the patch notes are vulnerable to exploitation over the network without requiring user credentials. However, Oracle, notes that two Human Resources software bugs, which ranked 9.9 out of 10 in severity, were not vulnerable to a remote attack.

Oracle is urging all customers to apply the security patches as soon as possible.

Citrix Scrabbles to Resolve Vulnerabilities

Continuing this theme, Citrix began 2020 on a particularly sore note after it announced that a particularly nasty vulnerability affecting the Citrix Application Delivery Controller (ADC) and Citrix Gateway had been discovered. Citrix reports that the vulnerability, first discovered in December and affecting all product versions 10.5 to 13.0, could allow attackers to access private enterprise networks without authentication.

Perhaps the biggest issue is the company only began rolling out patches this week and fixes for its SD-WAN and other ADC iterations yet to surface.

The company has, however, launched a compromise detection tool alongside cybersecurity firm FireEye that aims to help users determine whether their Citrix ADC or Gateways have been affected by the vulnerability. The tool is available for download on both the Citrix and FireEye Github repositories.

“We urge customers to immediately install these fixes,” Citrix’s Chief Information Security Officer Fermin Serna noted in a blog post.

The ongoing vulnerabilities are something of a sore spot for the vendor, which has struggled to fortify confidence in its services following a particularly embarrassing breach of its internal network by cybercriminals.