Microsoft Patch Tuesday — March 2020
Tuesday, 10 March 2020
Exploited 2
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 10.0
CVE-2020-0796 Exploited Public exploit A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…EPSS 100%
-
High 7.8
CVE-2020-0787 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows …EPSS 43%
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
All vulnerabilities 116
Critical1 ShowHide
-
Critical 10.0
CVE-2020-0796 Exploited Public exploit A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…EPSS 100%
High16 ShowHide
-
High 7.8
CVE-2020-0787 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows …EPSS 43%
- High 7.5 EPSS 8.7%
- High 7.5 EPSS 7.7%
- High 7.5 EPSS 7.9%
- High 7.5 EPSS 5.5%
- High 7.5 EPSS 8.9%
- High 7.5 EPSS 13%
- High 7.5 EPSS 8.9%
- High 7.5 EPSS 13%
- High 7.5 EPSS 8.9%
- High 7.5 EPSS 8.9%
- High 7.5 EPSS 8.7%
- High 7.5 EPSS 8.9%
- High 7.5 EPSS 8.7%
- High 7.5 EPSS 8.7%
- High 7.5 EPSS 9.6%
Medium5 ShowHide
-
Medium 5.4
CVE-2020-0795 This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated at…EPSS 1.5%
-
Medium 5.4
CVE-2020-0891 This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated at…EPSS 1.5%
-
Medium 5.4
CVE-2020-0893 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.3%
-
Medium 5.4
CVE-2020-0894 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.3%
-
Medium 5.4
CVE-2020-0903 A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exch…EPSS 1.6%
Unscored94 ShowHide
-
Unscored
CVE-2020-0887 Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 2.2%
-
Unscored
CVE-2020-0645 A tampering vulnerability exists when Microsoft IIS Server improperly handles malformed request headers, aka 'Microsoft IIS Server Tampering Vulnerability'.EPSS 3.9%
-
Unscored
CVE-2020-0684 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful…EPSS 9%
-
Unscored
CVE-2020-0690 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.EPSS 7%
-
Unscored
CVE-2020-0700 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site …EPSS 1.3%
-
Unscored
CVE-2020-0758 An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps S…EPSS 2%
- Unscored
- Unscored
-
Unscored
CVE-2020-0765 An information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a r…EPSS 4.7%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0774 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 5.9%
-
Unscored
CVE-2020-0775 An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerability, an attacker would…EPSS 1.3%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0791 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat…EPSS 1.1%
- Unscored
-
Unscored
CVE-2020-0797 An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevat…EPSS 1%
-
Unscored
CVE-2020-0798 An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr…EPSS 1%
- Unscored
-
Unscored
CVE-2020-0800 An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevat…EPSS 1%
-
Unscored
CVE-2020-0801 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil…EPSS 5.3%
-
Unscored
CVE-2020-0802 An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connecti…EPSS 1%
-
Unscored
CVE-2020-0803 An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connecti…EPSS 1%
- Unscored
- Unscored
-
Unscored
CVE-2020-0807 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil…EPSS 5.6%
- Unscored
-
Unscored
CVE-2020-0809 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil…EPSS 5.6%
-
Unscored
CVE-2020-0810 An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file creation in arbi…EPSS 1%
-
Unscored
CVE-2020-0814 An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v…EPSS 1.2%
-
Unscored
CVE-2020-0815 An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps S…EPSS 1.8%
-
Unscored
CVE-2020-0816 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.EPSS 11%
- Unscored
-
Unscored
CVE-2020-0820 An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory, aka 'Media Foundation Information Disclosure Vulnera…EPSS 1.3%
- Unscored
-
Unscored
CVE-2020-0824 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili…EPSS 7.2%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0842 An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v…EPSS 1%
-
Unscored
CVE-2020-0843 An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v…EPSS 1%
- Unscored
- Unscored
-
Unscored
CVE-2020-0847 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.EPSS 7.9%
- Unscored
-
Unscored
CVE-2020-0850 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 8.8%
-
Unscored
CVE-2020-0851 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 12%
-
Unscored
CVE-2020-0852 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 12%
-
Unscored
CVE-2020-0853 An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory, aka 'Windows Imaging C…EPSS 6.6%
- Unscored
-
Unscored
CVE-2020-0855 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 12%
- Unscored
- Unscored
-
Unscored
CVE-2020-0859 An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Inform…EPSS 1.3%
- Unscored
-
Unscored
CVE-2020-0861 An information disclosure vulnerability exists when the Windows Network Driver Interface Specification (NDIS) improperly handles memory.To exploit this vulnera…EPSS 1%
-
Unscored
CVE-2020-0863 An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information, aka 'Connected User Ex…EPSS 1.5%
- Unscored
-
Unscored
CVE-2020-0865 An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevat…EPSS 1%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0869 A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil…EPSS 4.7%
-
Unscored
CVE-2020-0871 An information disclosure vulnerability exists when Windows Network Connections Service fails to properly handle objects in memory, aka 'Windows Network Connec…EPSS 1.4%
-
Unscored
CVE-2020-0872 A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party …EPSS 10%
-
Unscored
CVE-2020-0874 An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r…EPSS 1.4%
-
Unscored
CVE-2020-0876 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 5.9%
-
Unscored
CVE-2020-0877 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 1%
-
Unscored
CVE-2020-0879 An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r…EPSS 1.7%
-
Unscored
CVE-2020-0880 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 6.3%
-
Unscored
CVE-2020-0881 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 17%
-
Unscored
CVE-2020-0882 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 6.3%
-
Unscored
CVE-2020-0883 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 22%
-
Unscored
CVE-2020-0884 A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing Vulnera…EPSS 1.7%
-
Unscored
CVE-2020-0885 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Graphics Component …EPSS 4.6%
-
Unscored
CVE-2020-0892 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 12%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-0902 An elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Service Fabric Elevation of Privilege'.EPSS 2.9%
-
Unscored
CVE-2020-0905 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.EPSS 11%