Microsoft Patch Tuesday — February 2020
Tuesday, 11 February 2020
Exploited 4
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 9.8
CVE-2020-0618 Exploited Public exploit A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Re…EPSS 99%
-
High 8.8
CVE-2020-0688 Exploited Public exploit A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchan…EPSS 100%
-
High 7.8
CVE-2020-0683 Exploited Public exploit An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege…EPSS 7.7%
-
High 7.5
CVE-2020-0674 Exploited Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 87%
Public exploit code 4
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2020-0668 Public exploit An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera…EPSS 26%
-
Unscored
CVE-2020-0665 Public exploit An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request …EPSS 4.4%
-
Unscored
CVE-2020-0728 Public exploit An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Inform…EPSS 3.8%
-
Unscored
CVE-2020-0753 Public exploit An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of …EPSS 2.3%
All vulnerabilities 99
Critical1 ShowHide
-
Critical 9.8
CVE-2020-0618 Exploited Public exploit A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Re…EPSS 99%
High8 ShowHide
-
High 8.8
CVE-2020-0688 Exploited Public exploit A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchan…EPSS 100%
-
High 7.8
CVE-2020-0683 Exploited Public exploit An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege…EPSS 7.7%
-
High 7.5
CVE-2020-0674 Exploited Public exploit A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 87%
- High 7.5 EPSS 10%
- High 7.5 EPSS 10%
- High 7.5 EPSS 10%
- High 7.5 EPSS 10%
- High 7.5 EPSS 18%
Medium2 ShowHide
-
Medium 5.4
CVE-2020-0693 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.6%
-
Medium 5.4
CVE-2020-0694 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.6%
Unscored88 ShowHide
-
Unscored
CVE-2020-0668 Public exploit An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera…EPSS 26%
-
Unscored
CVE-2020-0665 Public exploit An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request …EPSS 4.4%
-
Unscored
CVE-2020-0728 Public exploit An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Inform…EPSS 3.8%
-
Unscored
CVE-2020-0753 Public exploit An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of …EPSS 2.3%
-
Unscored
CVE-2020-0655 A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated attacker abuses clipb…EPSS 66%
- Unscored
-
Unscored
CVE-2020-0658 An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory, aka 'Win…EPSS 1.5%
- Unscored
-
Unscored
CVE-2020-0660 A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted …EPSS 5.4%
-
Unscored
CVE-2020-0661 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s…EPSS 1.6%
-
Unscored
CVE-2020-0662 A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.EPSS 13%
-
Unscored
CVE-2020-0663 An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access inf…EPSS 1.6%
- Unscored
- Unscored
-
Unscored
CVE-2020-0669 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera…EPSS 1.3%
-
Unscored
CVE-2020-0670 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V…EPSS 1.4%
-
Unscored
CVE-2020-0671 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V…EPSS 1.4%
-
Unscored
CVE-2020-0672 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V…EPSS 1.4%
-
Unscored
CVE-2020-0673 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 9.9%
-
Unscored
CVE-2020-0675 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
-
Unscored
CVE-2020-0676 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
-
Unscored
CVE-2020-0677 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0681 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote…EPSS 11%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0689 A security feature bypass vulnerability exists in secure boot, aka 'Microsoft Secure Boot Security Feature Bypass Vulnerability'.EPSS 1.1%
- Unscored
-
Unscored
CVE-2020-0692 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.EPSS 3.3%
- Unscored
-
Unscored
CVE-2020-0696 A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Secu…EPSS 5%
- Unscored
-
Unscored
CVE-2020-0698 An information disclosure vulnerability exists when the Telephony Service improperly discloses the contents of its memory, aka 'Windows Information Disclosure …EPSS 1.5%
- Unscored
- Unscored
-
Unscored
CVE-2020-0703 An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.To exploit this vulnerability, an attacker wo…EPSS 1%
- Unscored
-
Unscored
CVE-2020-0705 An information disclosure vulnerability exists when the Windows Network Driver Interface Specification (NDIS) improperly handles memory.To exploit this vulnera…EPSS 1.5%
-
Unscored
CVE-2020-0706 An information disclosure vulnerability exists in the way that affected Microsoft browsers handle cross-origin requests, aka 'Microsoft Browser Information Dis…EPSS 5.1%
- Unscored
-
Unscored
CVE-2020-0708 A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first …EPSS 14%
- Unscored
-
Unscored
CVE-2020-0714 An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.EPSS 1.4%
- Unscored
-
Unscored
CVE-2020-0716 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 1.5%
-
Unscored
CVE-2020-0717 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 1.5%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0729 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful…EPSS 31%
- Unscored
-
Unscored
CVE-2020-0731 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1.1%
- Unscored
- Unscored
-
Unscored
CVE-2020-0734 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote…EPSS 17%
- Unscored
-
Unscored
CVE-2020-0736 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera…EPSS 1.5%
- Unscored
-
Unscored
CVE-2020-0738 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil…EPSS 6.1%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0744 An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r…EPSS 1.9%
- Unscored
-
Unscored
CVE-2020-0746 An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Infor…EPSS 5.1%
- Unscored
-
Unscored
CVE-2020-0748 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
- Unscored
- Unscored
-
Unscored
CVE-2020-0751 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest oper…EPSS 1.4%
- Unscored
-
Unscored
CVE-2020-0754 An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of …EPSS 1.5%
-
Unscored
CVE-2020-0755 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
-
Unscored
CVE-2020-0756 An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit …EPSS 1.6%
- Unscored
-
Unscored
CVE-2020-0759 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem…EPSS 15%
-
Unscored
CVE-2020-0792 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat…EPSS 1.3%