CVE-2020-17048 – Chakra Scripting Engine Memory Corruption Vulnerability

https://notcve.org/view.php?id=CVE-2020-17048

11 Nov 2020 — Chakra Scripting Engine Memory Corruption Vulnerability Vulnerabilidad de Corrupción de Memoria del Motor de Scripting de Chakra Este ID de CVE es diferente deCVE-2020-17054. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of array iterator objects. By performing act... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17048 • CWE-787: Out-of-bounds Write •

CVE-2020-17014 – Windows Print Spooler Elevation of Privilege Vulnerability

https://notcve.org/view.php?id=CVE-2020-17014

11 Nov 2020 — Windows Print Spooler Elevation of Privilege Vulnerability Vulnerabilidad de Elevación de Privilegios de Windows Print Spooler Este ID de CVE es diferente de CVE-2020-17001 This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Print Spooler service. By creating a di... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17014 •

CVE-2020-17049 – Kerberos KDC Security Feature Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2020-17049

11 Nov 2020 —

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).

To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.

The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Vulnerabilidad d... • http://www.openwall.com/lists/oss-security/2021/11/10/3 • CWE-345: Insufficient Verification of Data Authenticity CWE-863: Incorrect Authorization •

CVE-2020-17087 – Microsoft Windows Kernel Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2020-17087

30 Oct 2020 — Windows Kernel Local Elevation of Privilege Vulnerability Vulnerabilidad de elevación de privilegios local del kernel de Windows Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation. • https://packetstorm.news/files/id/159777 • CWE-131: Incorrect Calculation of Buffer Size •

CVE-2020-1243 – Windows Hyper-V Denial of Service Vulnerability

https://notcve.org/view.php?id=CVE-2020-1243

16 Oct 2020 —

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system.

To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.

The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to handle these requests.

Se present... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1243 •

CVE-2020-1167 – Microsoft Graphics Components Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2020-1167

16 Oct 2020 —

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.

To exploit the vulnerability, a user would have to open a specially crafted file.

The security update addresses the vulnerability by correcting how Microsoft Graphics Components handle objects in memory.

Se presenta una vulnerabilidad de ejecución de código remota en ... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1167 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •

CVE-2020-1080 – Windows Hyper-V Elevation of Privilege Vulnerability

https://notcve.org/view.php?id=CVE-2020-1080

16 Oct 2020 —

An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.

This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could ... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1080 •

CVE-2020-1047 – Windows Hyper-V Elevation of Privilege Vulnerability

https://notcve.org/view.php?id=CVE-2020-1047

16 Oct 2020 —

An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.

This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could ... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1047 •

CVE-2020-16980 – Windows iSCSI Target Service Elevation of Privilege Vulnerability

https://notcve.org/view.php?id=CVE-2020-16980

16 Oct 2020 — <p>An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p> <p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p> <p>The security update addresses the vulnerability by ensuring the Windows iSCSI Target Service properly handles file operations. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16980 •

CVE-2020-16976 – Windows Backup Service Elevation of Privilege Vulnerability

https://notcve.org/view.php?id=CVE-2020-16976

16 Oct 2020 —

An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.

To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.

The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.

Se presenta una vulnerabilidad de escalada de privilegios cuando el Windows ... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16976 •