Archive
July 2020
Vulnerabilities first published in this month (UTC), newest first.
1,428 results · Feed
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To expl…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Picker Platform improperly handles memory.To exploit th…
-
Unscored —CVE-2020-1362 Public exploit
An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka…
-
Unscored —
An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerab…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation servic…
-
Unscored —
An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To …
-
Unscored —
An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit t…
-
Unscored —
A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker wh…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows USO Core Worker improperly handles memory.To exploit th…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Wind…
-
Unscored —
An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory…
-
Critical 10.0
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle re…
KEV Nov 3, 2021 -
Unscored —
An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, a…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka…
-
Unscored —
An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an unini…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka…
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authent…
-
Unscored —
An elevation of privilege vulnerability exists when Group Policy Services Policy Processing improperly handle reparse p…
-
Unscored —
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided inp…
-
Unscored —
An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handl…
-
Unscored —
This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when…
-
Unscored —
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Wind…
-
High 7.8
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulne…
KEV Nov 3, 2021 -
Unscored —CVE-2020-1240 EPSS 13%
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obj…
-
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Unscored —
An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects i…
-
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Critical 9.0CVE-2020-1040 Exploited
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
KEV Nov 3, 2021 -
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Unscored —
A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate inp…
-
Unscored —
Microsoft Office Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper a…
-
Medium 4.6
TLS Validation Vulnerability in Envoy
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly…
-
Low 2.8
Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted us…
-
Medium 6.4
Command Injection in iPear
In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal d…
-
Low 3.5
Stored XSS in October
In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Thi…
-
High 7.7
LDAP injection vulnerability in Traccar GPS Tracking System
Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges…