Microsoft Patch Tuesday — July 2020
Tuesday, 14 July 2020
Exploited 3
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 10.0
CVE-2020-1350 Exploited Public exploit A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C…EPSS 97%
-
Critical 9.0
CVE-2020-1040 Exploited A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 7.6%
-
High 7.8
CVE-2020-1147 Exploited Public exploit .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution VulnerabilityEPSS 96%
Public exploit code 2
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2020-1349 Public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Co…EPSS 23%
-
Unscored
CVE-2020-1362 Public exploit An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Pri…EPSS 2.5%
All vulnerabilities 123
Critical2 ShowHide
-
Critical 10.0
CVE-2020-1350 Exploited Public exploit A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C…EPSS 97%
-
Critical 9.0
CVE-2020-1040 Exploited A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 7.6%
High3 ShowHide
-
High 7.8
CVE-2020-1147 Exploited Public exploit .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution VulnerabilityEPSS 96%
- High 7.8
- High 7.5 EPSS 4.8%
Medium4 ShowHide
-
Medium 5.4
CVE-2020-1450 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.6%
-
Medium 5.4
CVE-2020-1451 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 1.6%
-
Medium 5.4
CVE-2020-1454 This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated at…EPSS 1.6%
-
Medium 5.4
CVE-2020-1456 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh…EPSS 2.2%
Unscored114 ShowHide
-
Unscored
CVE-2020-1349 Public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Co…EPSS 23%
-
Unscored
CVE-2020-1362 Public exploit An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Pri…EPSS 2.5%
- Unscored EPSS 5.9%
-
Unscored
CVE-2020-1032 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 6.1%
-
Unscored
CVE-2020-1036 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 6.3%
-
Unscored
CVE-2020-1041 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 6.1%
-
Unscored
CVE-2020-1042 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 6.2%
-
Unscored
CVE-2020-1043 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 6.1%
- Unscored
-
Unscored
CVE-2020-1240 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem…EPSS 13%
- Unscored
-
Unscored
CVE-2020-1267 This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a speci…EPSS 4.5%
-
Unscored
CVE-2020-1326 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site …EPSS 1.6%
-
Unscored
CVE-2020-1330 An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device…EPSS 1.3%
- Unscored
-
Unscored
CVE-2020-1342 An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose …EPSS 6.4%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1351 An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka 'Microsoft Graphics Component Info…EPSS 1.4%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1355 A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploited the vulnerabili…EPSS 4.2%
- Unscored
- Unscored
-
Unscored
CVE-2020-1358 An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To exploit this vulnerability, an attacker …EPSS 1.3%
- Unscored
- Unscored
-
Unscored
CVE-2020-1361 An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker would first need code…EPSS 1.3%
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1367 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera…EPSS 1.3%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1374 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote…EPSS 9.1%
-
Unscored
CVE-2020-1375 An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerabilit…EPSS 7.1%
-
Unscored
CVE-2020-1381 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat…EPSS 1%
-
Unscored
CVE-2020-1382 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat…EPSS 5.4%
- Unscored
- Unscored
-
Unscored
CVE-2020-1386 An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information, aka 'Connected User Ex…EPSS 1.3%
- Unscored
- Unscored
-
Unscored
CVE-2020-1389 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosur…EPSS 1.3%
- Unscored
-
Unscored
CVE-2020-1391 An information disclosure vulnerability exists when the Windows Agent Activation Runtime (AarSvc) fails to properly handle objects in memory, aka 'Windows Agen…EPSS 1.3%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1397 An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory, aka 'Windows Imaging C…EPSS 6.4%
-
Unscored
CVE-2020-1398 An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly handle Ease of Access dialog.An attacker who successfully exploited th…EPSS 1.2%
- Unscored
-
Unscored
CVE-2020-1400 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex…EPSS 24%
-
Unscored
CVE-2020-1401 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex…EPSS 13%
- Unscored
-
Unscored
CVE-2020-1403 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.EPSS 10%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1407 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex…EPSS 11%
-
Unscored
CVE-2020-1408 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote …EPSS 5.6%
-
Unscored
CVE-2020-1409 A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'.EPSS 12%
-
Unscored
CVE-2020-1410 A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability, an attacker could s…EPSS 12%
- Unscored
-
Unscored
CVE-2020-1412 A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote …EPSS 14%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1416 An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Stud…EPSS 5.9%
-
Unscored
CVE-2020-1418 An elevation of privilege vulnerability exists when the Windows Diagnostics Execution Service fails to properly sanitize input, leading to an unsecure library-…EPSS 1%
-
Unscored
CVE-2020-1419 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosur…EPSS 1.4%
-
Unscored
CVE-2020-1420 An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerability, an attacker would…EPSS 1.3%
-
Unscored
CVE-2020-1421 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful…EPSS 75%
- Unscored
- Unscored
-
Unscored
CVE-2020-1424 An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of…EPSS 1.4%
-
Unscored
CVE-2020-1426 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera…EPSS 1.3%
- Unscored
- Unscored
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2020-1432 An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Internet Explorer Informa…EPSS 4.5%
-
Unscored
CVE-2020-1433 An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information Disclos…EPSS 5.3%
- Unscored
-
Unscored
CVE-2020-1435 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 14%
-
Unscored
CVE-2020-1436 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an att…EPSS 21%
- Unscored
- Unscored
-
Unscored
CVE-2020-1439 A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file …EPSS 20%
-
Unscored
CVE-2020-1442 A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.EPSS 1.7%
-
Unscored
CVE-2020-1443 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a…EPSS 1.7%
-
Unscored
CVE-2020-1444 A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'Microsoft SharePoint Remote…EPSS 9.1%
-
Unscored
CVE-2020-1445 An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclos…EPSS 6.1%
-
Unscored
CVE-2020-1446 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 11%
-
Unscored
CVE-2020-1447 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 11%
-
Unscored
CVE-2020-1448 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe…EPSS 10%
-
Unscored
CVE-2020-1449 A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project…EPSS 4.6%
-
Unscored
CVE-2020-1458 A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL) files, aka 'Microsoft O…EPSS 11%
- Unscored
-
Unscored
CVE-2020-1462 An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft E…EPSS 4.2%
- Unscored
- Unscored
-
Unscored
CVE-2020-1468 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 5.2%
-
Unscored
CVE-2020-1481 A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual …EPSS 24%