2020-12-10 - CVE Archive

CVE-2020-17136 Dec 10, 00:15 HIGH POC PATCH THREAT Act Now

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2016 Windows Server 2019 Windows 10

NVD GitHub

CVSS 3.1

7.8

EPSS

14.0%

CVE-2020-25967 Dec 10, 23:15 HIGH POC This Week

The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Code Injection Fastadmin

NVD

CVSS 3.1

8.8

EPSS

1.3%

CVE-2020-13526 Dec 10, 23:15 HIGH POC This Week

SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

SQLi Processmaker

NVD

CVSS 3.1

8.8

EPSS

1.7%

CVE-2020-26267 Dec 10, 23:15 HIGH POC PATCH This Week

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

Buffer Overflow Information Disclosure Google Tensorflow

NVD GitHub

CVSS 3.1

7.8

EPSS

0.2%

CVE-2020-26269 Dec 10, 23:15 HIGH POC PATCH This Week

In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Buffer Overflow Information Disclosure Google Tensorflow

NVD GitHub

CVSS 3.1

7.5

EPSS

0.7%

CVE-2020-17103 Dec 10, 00:15 HIGH POC PATCH This Week

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). Public exploit code available.

Privilege Escalation Microsoft

NVD GitHub VulDB

CVSS 3.1

7.0

EPSS

0.5%

CVE-2020-17158 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

RCE Microsoft Dynamics 365

NVD

CVSS 3.1

8.8

EPSS

2.7%

CVE-2020-17152 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

RCE Microsoft Dynamics 365

NVD

CVSS 3.1

8.8

EPSS

2.7%

CVE-2020-17143 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure Microsoft Exchange Server

NVD

CVSS 3.1

8.8

EPSS

70.6%

CVE-2020-17121 Dec 10, 00:15 HIGH PATCH This Week

Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

RCE Microsoft Sharepoint Server Sharepoint Foundation

NVD

CVSS 3.1

8.8

EPSS

3.1%

CVE-2020-17147 Dec 10, 00:15 HIGH PATCH This Week

Dynamics CRM Webclient Cross-site Scripting Vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Microsoft Dynamics 365

NVD

CVSS 3.1

8.7

EPSS

1.5%

CVE-2020-17095 Dec 10, 00:15 HIGH PATCH This Week

Windows Hyper-V Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable.

RCE Microsoft Windows Server 2016 Windows Server 2019 Windows 10

NVD

CVSS 3.1

8.5

EPSS

5.2%

CVE-2020-17144 Dec 10, 00:15 HIGH KEV PATCH THREAT This Week

Microsoft Exchange Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

RCE Deserialization Microsoft Exchange Server

NVD

CVSS 3.1

8.4

EPSS

36.5%

CVE-2020-17141 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Exchange Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity.

RCE Microsoft Exchange Server

NVD

CVSS 3.1

8.4

EPSS

7.4%

CVE-2020-17140 Dec 10, 00:15 HIGH PATCH This Week

Windows SMB Information Disclosure Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2012 Windows Server 2016 +5

NVD

CVSS 3.1

8.1

EPSS

12.2%

CVE-2020-17118 Dec 10, 00:15 HIGH PATCH This Week

Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

RCE Microsoft Sharepoint Server Sharepoint Foundation

NVD

CVSS 3.1

8.1

EPSS

3.7%

CVE-2020-17115 Dec 10, 00:15 HIGH PATCH This Week

Microsoft SharePoint Server Spoofing Vulnerability. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure Microsoft Sharepoint Server Sharepoint Foundation

NVD

CVSS 3.1

8.0

EPSS

2.6%

CVE-2020-4829 Dec 10, 23:15 HIGH PATCH This Week

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure IBM Aix Vios

NVD

CVSS 3.1

7.8

EPSS

0.3%

CVE-2020-17159 Dec 10, 00:15 HIGH PATCH This Week

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Java Red Hat Language Support For Java

NVD

CVSS 3.1

7.8

EPSS

3.1%

CVE-2020-17156 Dec 10, 00:15 HIGH PATCH This Week

Visual Studio Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Visual Studio 2017 Visual Studio 2019

NVD

CVSS 3.1

7.8

EPSS

2.9%

CVE-2020-17150 Dec 10, 00:15 HIGH PATCH This Week

Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Tslint

NVD

CVSS 3.1

7.8

EPSS

2.9%

CVE-2020-17148 Dec 10, 00:15 HIGH PATCH This Week

Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Visual Studio Code

NVD

CVSS 3.1

7.8

EPSS

3.6%

CVE-2020-17139 Dec 10, 00:15 HIGH PATCH This Week

Windows Overlay Filter Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Authentication Bypass Microsoft Windows Server 2016 Windows Server 2019 Windows 10

NVD

CVSS 3.1

7.8

EPSS

1.0%

CVE-2020-17137 Dec 10, 00:15 HIGH PATCH This Week

DirectX Graphics Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2016 Windows 10

NVD

CVSS 3.1

7.8

EPSS

0.8%

CVE-2020-17134 Dec 10, 00:15 HIGH PATCH This Week

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2016 Windows Server 2019 Windows 10

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-17129 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Excel Office +2

NVD

CVSS 3.1

7.8

EPSS

3.3%

CVE-2020-17128 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Excel Office +2

NVD

CVSS 3.1

7.8

EPSS

2.6%

CVE-2020-17127 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Excel

NVD

CVSS 3.1

7.8

EPSS

3.3%

CVE-2020-17125 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Excel Office +2

NVD

CVSS 3.1

7.8

EPSS

3.3%

CVE-2020-17124 Dec 10, 00:15 HIGH PATCH This Week

Microsoft PowerPoint Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Office Powerpoint

NVD

CVSS 3.1

7.8

EPSS

3.3%

CVE-2020-17123 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft 365 Apps Excel Office Online Server +1

NVD

CVSS 3.1

7.8

EPSS

3.6%

CVE-2020-17122 Dec 10, 00:15 HIGH PATCH This Week

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

RCE Microsoft Office Sharepoint Server Office Web Apps

NVD

CVSS 3.1

7.8

EPSS

3.3%

CVE-2020-17092 Dec 10, 00:15 HIGH PATCH This Week

Windows Network Connections Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 +3

NVD

CVSS 3.1

7.8

EPSS

1.1%

CVE-2020-16964 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-16963 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-16962 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-16961 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.3%

CVE-2020-16960 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.3%

CVE-2020-16959 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-16958 Dec 10, 00:15 HIGH PATCH This Week

Windows Backup Engine Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Information Disclosure Microsoft Windows Server 2008 Windows Server 2016 Windows Server 2019 +2

NVD

CVSS 3.1

7.8

EPSS

1.2%

CVE-2020-12516 Dec 10, 03:15 HIGH PATCH This Week

Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Denial Of Service 750 881 Firmware 750 880 Firmware 750 852 Firmware 750 882 Firmware +7

NVD

CVSS 3.1

7.5

EPSS

1.9%

CVE-2020-17096 Dec 10, 00:15 HIGH PATCH This Week

Windows NTFS Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.

RCE Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 +3

NVD

CVSS 3.1

7.5

EPSS

18.7%

CVE-2020-17002 Dec 10, 00:15 HIGH PATCH This Week

Azure SDK for C Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.

Authentication Bypass Microsoft C Sdk For Azure Iot

NVD

CVSS 3.1

7.4

EPSS

3.2%

CVE-2020-16971 Dec 10, 00:15 HIGH PATCH This Week

Azure SDK for Java Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Authentication Bypass Java Microsoft Azure Sdk For Java

NVD

CVSS 3.1

7.4

EPSS

3.6%

CVE-2020-12594 Dec 10, 06:15 HIGH This Week

A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Privilege Escalation Broadcom Symantec Messaging Gateway

NVD

CVSS 3.1

7.2

EPSS

1.5%

CVE-2020-17089 Dec 10, 00:15 HIGH PATCH This Week

Microsoft SharePoint Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable.

Information Disclosure Microsoft Sharepoint Server Sharepoint Foundation

NVD

CVSS 3.1

7.1

EPSS

2.8%