deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6489
Published: 2020-05-21
Description: Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain actions in developer tools to obtain potentially sensitive information from disk via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6490
Published: 2020-05-21
Description: Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-6491
Published: 2020-05-21
Description: Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html; https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
CVE: CVE-2020-1799
Published: 2020-05-21
Description: E6878-370 with versions of 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233) has a use after free vulnerability. The software references memory after it has been freed in certain scenario, the attacker does a series of crafted operations through web portal, successful exploit could cause a use after free condition which may lead to malicious code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-uaf-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-uaf-en
CVE: CVE-2020-5752
Published: 2020-05-21
Description: Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/157802/Druva-inSync-Windows-Client-6.6.3-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/160404/Druva-inSync-Windows-Client-6.6.3-Privilege-Escalation.html; https://www.tenable.com/security/research/tra-2020-34
CVE: CVE-2020-7655
Published: 2020-05-21
Description: netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-444
References: https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141; https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141
CVE: CVE-2020-8572
Published: 2020-05-21
Description: Element OS prior to version 12.0 and Element HealthTools prior to version 2020.04.01.04 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-9045
Published: 2020-05-21
Description: During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-312, CWE-312
References: https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.us-cert.gov/ics/advisories/ICSA-20-142-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2020-9069
Published: 2020-05-21
Description: There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data. Successful exploitation may leak information randomly. Affected product versions include: Anne-AL00 Versions earlier than 9.1.0.331(C675E9R1P3T8); Berkeley-L09 Versions earlier than 10.0.1.1(C675R1); CD16-10 Versions earlier than 10.0.2.8; CD17-10 Versions earlier than 10.0.2.8; CD17-16 Versions earlier than 10.0.2.8; CD18-10 Versions earlier than 10.0.2.8; CD18-16 Versions earlier than 10.0.2.8; Columbia-TL00B Versions earlier than 9.0.0.187(C01E181R1P20T8); E6878-370 Versions earlier than 10.0.5.1(H610SP10C00); HUAWEI P30 lite Versions earlier than 10.0.0.185(C605E3R1P3), Versions earlier than 10.0.0.197(C432E8R2P7); HUAWEI nova 4e Versions earlier than 10.0.0.158(C00E64R1P9); Honor 10 Lite 9.0.1.113(C675E11R1P12); LelandP-L22A Versions earlier than 9.1.0.166(C675E5R1P4T8); Marie-AL00AX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00AY Versions earlier than 10.0.0.158(C00E64R1P9); Marie-AL00BX Versions earlier than 10.0.0.158(C00E64R1P9); Marie-L03BX Versions earlier than 10.0.0.188(C605E5R1P1); Marie-L21BX Versions earlier than 10.0.0.188(C432E4R4P1), Versions earlier than 10.0.0.188(C461E5R3P1); Marie-L22BX Versions earlier than 10.0.0.188(C636E3R3P1); Marie-L23BX Versions earlier than 10.0.0.188(C605E5R1P1); TC5200-16 Versions earlier than 10.0.2.8; WS5200-11 Versions earlier than 10.0.2.8; WS5200-12 Versions earlier than 10.0.2.23; WS5200-16 Versions earlier than 10.0.2.8; WS5200-17 Versions earlier than 10.0.2.23; WS5800-10 Versions earlier than 10.0.3.27; WS6500-10 Versions earlier than 10.0.2.8; WS6500-16 Versions earlier than 10.0.2.8
CVSS Score: 6.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-leakage-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-leakage-en
CVE: CVE-2020-10738
Published: 2020-05-21
Description: A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68410; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10738; https://moodle.org/mod/forum/discuss.php?d=403513
CVE: CVE-2020-13112
Published: 2020-05-21
Description: An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://github.com/libexif/libexif/commit/435e21f05001fb03f9f186fa7cbc69454afd00d1; https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
CVE: CVE-2020-13114
Published: 2020-05-21
Description: An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab; https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
CVE: CVE-2020-12431
Published: 2020-05-21
Description: A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-732
References: https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer; https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/[PII_REDACTED]31-Splashtop-Streamer-version-3-3-8-0-for-Windows-released-includes-SOS-version-3-3-8-0; https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer
CVE: CVE-2020-12828
Published: 2020-05-21
Description: An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.pango.co/sec31944/; https://www.pango.co/sec31944/
CVE: CVE-2020-13113
Published: 2020-05-21
Description: An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
CVSS Score: 8.2 (HIGH)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c[PII_REDACTED]9d1f; https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
CVE: CVE-2020-13258
Published: 2020-05-21
Description: Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/contentful/the-example-app.py/issues/44; https://github.com/contentful/the-example-app.py/issues/44
CVE: CVE-2020-7808
Published: 2020-05-21
Description: In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
CVSS Score: 8.7 (HIGH)
CWE: CWE-88, CWE-353, CWE-88
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35424; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35424
CVE: CVE-2017-18868
Published: 2020-05-21
Description: Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the ZigBee protocol is built.
CVSS Score: 7.7 (HIGH)
CWE: CWE-276
References: https://www.hindawi.com/journals/scn/2017/1723658/; https://www.hindawi.com/journals/scn/2017/1723658/
CVE: CVE-2019-20803
Published: 2020-05-21
Description: Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158201/GilaCMS-1.11.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2020/Jun/29; https://github.com/GilaCMS/gila/issues/56
CVE: CVE-2019-20804
Published: 2020-05-21
Description: Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/158201/GilaCMS-1.11.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2020/Jun/29; https://github.com/GilaCMS/gila/issues/57
CVE: CVE-2018-21234
Published: 2020-05-21
Description: Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16; https://github.com/oblac/jodd/compare/v5.0.3...v5.0.4; https://github.com/oblac/jodd/issues/628
CVE: CVE-2020-0901
Published: 2020-05-21
Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0901; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0901
CVE: CVE-2020-0909
Published: 2020-05-21
Description: A denial of service vulnerability exists when Hyper-V on a Windows Server fails to properly handle specially crafted network packets.To exploit the vulnerability, an attacker would send specially crafted network packets to the Hyper-V Server.The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to properly handle these network packets., aka 'Windows Hyper-V Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0909; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0909
CVE: CVE-2020-0963
Published: 2020-05-21
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1141, CVE-2020-1145, CVE-2020-1179.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0963; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0963
CVE: CVE-2020-12693
Published: 2020-05-21
Description: Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
CVSS Score: 8.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00063.html; https://lists.debian.org/debian-lts-announce/2022/01/msg00011.html
CVE: CVE-2020-1010
Published: 2020-05-21
Description: An elevation of privilege vulnerability exists in Windows Block Level Backup Engine Service (wbengine) that allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1068, CVE-2020-1079.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1010; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1010
CVE: CVE-2020-1021
Published: 2020-05-21
Description: An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1082, CVE-2020-1088.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://packetstormsecurity.com/files/158028/Microsoft-Windows-Privilege-Escalation-Code-Execution.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1021; http://packetstormsecurity.com/files/158028/Microsoft-Windows-Privilege-Escalation-Code-Execution.html
CVE: CVE-2020-1023
Published: 2020-05-21
Description: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1024, CVE-2020-1102.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1023; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1023
CVE: CVE-2020-1024
Published: 2020-05-21
Description: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1023, CVE-2020-1102.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1024; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1024
CVE: CVE-2020-1028
Published: 2020-05-21
Description: A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1126, CVE-2020-1136, CVE-2020-1150.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1028; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1028
CVE: CVE-2020-1035
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1058, CVE-2020-1060, CVE-2020-1093.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1035; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1035
CVE: CVE-2020-1037
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1037; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1037
CVE: CVE-2020-1048
Published: 2020-05-21
Description: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1070.
CVSS Score: 7.8 (HIGH)
CWE: CWE-669
References: http://packetstormsecurity.com/files/158222/Windows-Print-Spooler-Privilege-Escalation.html; http://packetstormsecurity.com/files/159217/Microsoft-Spooler-Local-Privilege-Elevation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1048
CVE: CVE-2020-1051
Published: 2020-05-21
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1174, CVE-2020-1175, CVE-2020-1176.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1051; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1051
CVE: CVE-2020-1054
Published: 2020-05-21
Description: An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1143.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/160515/Microsoft-Windows-DrawIconEx-Local-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1054; http://packetstormsecurity.com/files/160515/Microsoft-Windows-DrawIconEx-Local-Privilege-Escalation.html
CVE: CVE-2020-1055
Published: 2020-05-21
Description: A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs, aka 'Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1055; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1055
CVE: CVE-2020-1056
Published: 2020-05-21
Description: An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1056; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1056
CVE: CVE-2020-1058
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1035, CVE-2020-1060, CVE-2020-1093.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1058; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1058
CVE: CVE-2020-1059
Published: 2020-05-21
Description: A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka 'Microsoft Edge Spoofing Vulnerability'.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1059; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1059
CVE: CVE-2020-1060
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1035, CVE-2020-1058, CVE-2020-1093.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1060; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1060
CVE: CVE-2020-1061
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the Microsoft Script Runtime handles objects in memory, aka 'Microsoft Script Runtime Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1061; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1061
CVE: CVE-2020-1062
Published: 2020-05-21
Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1092.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1062; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1062
CVE: CVE-2020-1063
Published: 2020-05-21
Description: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1063; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1063
CVE: CVE-2020-1064
Published: 2020-05-21
Description: A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input.An attacker could execute arbitrary code in the context of the current user, aka 'MSHTML Engine Remote Code Execution Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1064; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1064