CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 0CVE-2020-1167 – Microsoft Graphics Components Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-1167
<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p> <p>To exploit the vulnerability, a user would have to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.</p> Se presenta una vulnerabilidad de ejecución de código remota en la manera en que Microsoft Graphics Components maneja objetos en memoria, también se conoce como "Microsoft Graphics Components Remote Code Execution Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1167 https://www.zerodayinitiative.com/advisories/ZDI-20-1247 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-1243 – Windows Hyper-V Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-1243
<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system.</p> <p>To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.</p> <p>The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to handle these requests.</p> Se presenta una vulnerabilidad de denegación de servicio cuando Microsoft Hyper-V en un servidor host presenta un fallo al comprobar apropiadamente datos maliciosos específicos de un usuario en un sistema operativo invitado. Para explotar la vulnerabilidad, un atacante que ya presenta una cuenta privilegiada en un sistema operativo invitado, ejecutándose como una máquina virtual, podría correr una aplicación especialmente diseñada. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1243 •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2020-1080 – Windows Hyper-V Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2020-1080
<p>An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.</p> <p>This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.</p> <p>The update addresses the vulnerabilities by correcting how Windows Hyper-V handles objects in memory. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1080 •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2020-1047 – Windows Hyper-V Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2020-1047
<p>An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.</p> <p>This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.</p> <p>The update addresses the vulnerabilities by correcting how Windows Hyper-V handles objects in memory. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1047 •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-16980 – Windows iSCSI Target Service Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2020-16980
<p>An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p> <p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p> <p>The security update addresses the vulnerability by ensuring the Windows iSCSI Target Service properly handles file operations. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16980 •