CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2020-17048 – Chakra Scripting Engine Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2020-17048
Chakra Scripting Engine Memory Corruption Vulnerability Vulnerabilidad de Corrupción de Memoria del Motor de Scripting de Chakra Este ID de CVE es diferente deCVE-2020-17054. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of array iterator objects. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17048 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 36%CPEs: 22EXPL: 3CVE-2020-17087 – Microsoft Windows Kernel Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-17087
Windows Kernel Local Elevation of Privilege Vulnerability Vulnerabilidad de elevación de privilegios local del kernel de Windows Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. • https://github.com/revengsh/CVE-2020-17087 https://github.com/raiden757/CVE-2020-17087 https://github.com/ykg88/OHTS_IE6052-CVE-2020-17087 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17087 • CWE-131: Incorrect Calculation of Buffer Size •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-1243 – Windows Hyper-V Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-1243
<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system.</p> <p>To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.</p> <p>The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to handle these requests.</p> Se presenta una vulnerabilidad de denegación de servicio cuando Microsoft Hyper-V en un servidor host presenta un fallo al comprobar apropiadamente datos maliciosos específicos de un usuario en un sistema operativo invitado. Para explotar la vulnerabilidad, un atacante que ya presenta una cuenta privilegiada en un sistema operativo invitado, ejecutándose como una máquina virtual, podría correr una aplicación especialmente diseñada. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1243 •
CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 0CVE-2020-1167 – Microsoft Graphics Components Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-1167
<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.</p> <p>To exploit the vulnerability, a user would have to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.</p> Se presenta una vulnerabilidad de ejecución de código remota en la manera en que Microsoft Graphics Components maneja objetos en memoria, también se conoce como "Microsoft Graphics Components Remote Code Execution Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1167 https://www.zerodayinitiative.com/advisories/ZDI-20-1247 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2020-1047 – Windows Hyper-V Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2020-1047
<p>An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.</p> <p>This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.</p> <p>The update addresses the vulnerabilities by correcting how Windows Hyper-V handles objects in memory. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1047 •