deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10492
Published: 2020-03-12
Description: CSRF in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete an article template via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf15; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-deleting-an-article-template-cve-2020-10492; http://antoniocannito.it/?p=343#csrf15
CVE: CVE-2020-10493
Published: 2020-03-12
Description: CSRF in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a glossary term, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf16; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-a-glossary-term-cve-2020-10493; http://antoniocannito.it/?p=343#csrf16
CVE: CVE-2020-10494
Published: 2020-03-12
Description: CSRF in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a news article, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf17; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-a-news-article-cve-2020-10494; http://antoniocannito.it/?p=343#csrf17
CVE: CVE-2020-10495
Published: 2020-03-12
Description: CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf18; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-an-article-template-cve-2020-10495; http://antoniocannito.it/?p=343#csrf18
CVE: CVE-2020-10496
Published: 2020-03-12
Description: CSRF in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf19; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-an-article-cve-2020-10496; http://antoniocannito.it/?p=343#csrf19
CVE: CVE-2020-10497
Published: 2020-03-12
Description: CSRF in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a category via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf20; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-deleting-a-category-cve-2020-10497; http://antoniocannito.it/?p=343#csrf20
CVE: CVE-2020-10498
Published: 2020-03-12
Description: CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf21; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-a-category-cve-2020-10498; http://antoniocannito.it/?p=343#csrf21
CVE: CVE-2020-10499
Published: 2020-03-12
Description: CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf22; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-closing-a-ticket-cve-2020-10499; http://antoniocannito.it/?p=343#csrf22
CVE: CVE-2020-10500
Published: 2020-03-12
Description: CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf23; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-replying-to-a-ticket-cve-2020-10500; http://antoniocannito.it/?p=343#csrf23
CVE: CVE-2020-10501
Published: 2020-03-12
Description: CSRF in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a department, given the id, via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf24; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-a-department-cve-2020-10501; http://antoniocannito.it/?p=343#csrf24
CVE: CVE-2020-10502
Published: 2020-03-12
Description: CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to approve any comment, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf25; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-approving-a-new-comment-cve-2020-10502; http://antoniocannito.it/?p=343#csrf25
CVE: CVE-2020-10503
Published: 2020-03-12
Description: CSRF in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to disapprove any comment, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf26; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-disapproving-a-new-comment-cve-2020-10503; http://antoniocannito.it/?p=343#csrf26
CVE: CVE-2020-10504
Published: 2020-03-12
Description: CSRF in admin/edit-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a comment, given the id, via a crafted request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://antoniocannito.it/?p=343#csrf27; https://antoniocannito.it/phpkb3#cross-site-request-forgery-when-editing-a-comment-cve-2020-10504; http://antoniocannito.it/?p=343#csrf27
CVE: CVE-2020-6858
Published: 2020-03-12
Description: Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://github.com/HotelsDotCom/styx/security/advisories/GHSA-6v7p-v754-j89v; https://twitter.com/JLLeitschuh; https://github.com/HotelsDotCom/styx/security/advisories/GHSA-6v7p-v754-j89v
CVE: CVE-2020-8435
Published: 2020-03-12
Description: An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://Spider-security.co.uk; https://spider-security.co.uk/blog-cve-2020-8435; https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers
CVE: CVE-2020-8436
Published: 2020-03-12
Description: XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://Spider-security.co.uk; https://spider-security.co.uk/blog-cve-2020-8436; https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers
CVE: CVE-2020-9435
Published: 2020-03-12
Description: PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation, man-in-the-middle, or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-Client-Command-Injection.html; http://seclists.org/fulldisclosure/2020/Mar/15; https://cert.vde.com/en-us/advisories/
CVE: CVE-2020-9436
Published: 2020-03-12
Description: PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/156729/Phoenix-Contact-TC-Router-TC-Cloud-Client-Command-Injection.html; http://seclists.org/fulldisclosure/2020/Mar/15; https://cert.vde.com/en-us/advisories/
CVE: CVE-2020-9464
Published: 2020-03-12
Description: A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restored by rebooting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert.vde.com/en-us/advisories/vde-2020-005; https://cert.vde.com/en-us/advisories/vde-2020-005
CVE: CVE-2020-0645
Published: 2020-03-12
Description: A tampering vulnerability exists when Microsoft IIS Server improperly handles malformed request headers, aka 'Microsoft IIS Server Tampering Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0645; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0645
CVE: CVE-2020-0684
Published: 2020-03-12
Description: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0684; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0684
CVE: CVE-2020-0690
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0690; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0690
CVE: CVE-2020-0700
Published: 2020-03-12
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0700; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0700
CVE: CVE-2020-0758
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps Server and Team Foundation Services Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0815.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0758; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0758
CVE: CVE-2020-0762
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Windows Defender Security Center Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0763.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0762; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0762
CVE: CVE-2020-0763
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when Windows Defender Security Center handles certain objects in memory.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Windows Defender Security Center Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0762.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0763; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0763
CVE: CVE-2020-0765
Published: 2020-03-12
Description: An information disclosure vulnerability exists in the Remote Desktop Connection Manager (RDCMan) application when it improperly parses XML input containing a reference to an external entity, aka 'Remote Desktop Connection Manager Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0765; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0765
CVE: CVE-2020-0768
Published: 2020-03-12
Description: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0768; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0768
CVE: CVE-2020-0769
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows CSC Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows CSC Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0771.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0769; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0769
CVE: CVE-2020-0770
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows ActiveX Installer Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows ActiveX Installer Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0773, CVE-2020-0860.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0770; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0770
CVE: CVE-2020-0771
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows CSC Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows CSC Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0769.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0771; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0771
CVE: CVE-2020-0772
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when Windows Error Reporting improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0806.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0772; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0772
CVE: CVE-2020-0773
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows ActiveX Installer Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows ActiveX Installer Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0770, CVE-2020-0860.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0773; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0773
CVE: CVE-2020-0774
Published: 2020-03-12
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0874, CVE-2020-0879, CVE-2020-0880, CVE-2020-0882.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0774; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0774
CVE: CVE-2020-0775
Published: 2020-03-12
Description: An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Error Reporting Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0775; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0775
CVE: CVE-2020-0776
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles file operations.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0858.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0776; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0776
CVE: CVE-2020-0777
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0797, CVE-2020-0800, CVE-2020-0864, CVE-2020-0865, CVE-2020-0866, CVE-2020-0897.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0777; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0777
CVE: CVE-2020-0778
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connections Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0802, CVE-2020-0803, CVE-2020-0804, CVE-2020-0845.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0778; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0778
CVE: CVE-2020-0779
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0798, CVE-2020-0814, CVE-2020-0842, CVE-2020-0843.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0779; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0779
CVE: CVE-2020-0780
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows Network List Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0780; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0780
CVE: CVE-2020-0781
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0783.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0781; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0781
CVE: CVE-2020-0783
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0781.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0783; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0783
CVE: CVE-2020-0785
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0785; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0785
CVE: CVE-2020-0786
Published: 2020-03-12
Description: A denial of service vulnerability exists when the Windows Tile Object Service improperly handles hard links, aka 'Windows Tile Object Service Denial of Service Vulnerability'.
CVSS Score: 7.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0786; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0786
CVE: CVE-2020-0787
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787; http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html
CVE: CVE-2020-0788
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0877, CVE-2020-0887.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0788; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0788
CVE: CVE-2020-0789
Published: 2020-03-12
Description: A denial of service vulnerability exists when the Visual Studio Extension Installer Service improperly handles hard links, aka 'Visual Studio Extension Installer Service Denial of Service Vulnerability'.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0789; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0789
CVE: CVE-2020-0791
Published: 2020-03-12
Description: An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0898.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0791; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0791