yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-16961: Windows Backup Engine Elevation of Privilege Vulnerability
Key phrases: windows backup engine elevation of privilege
CVE-2020-16962: Windows Backup Engine Elevation of Privilege Vulnerability
Key phrases: windows backup engine elevation of privilege
CVE-2020-16963: Windows Backup Engine Elevation of Privilege Vulnerability
Key phrases: windows backup engine elevation of privilege
CVE-2020-16964: Windows Backup Engine Elevation of Privilege Vulnerability
Key phrases: windows backup engine elevation of privilege
CVE-2020-16967: <p>A remote code execution vulnerability exists when the Windows Camera Codec Pack improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p><p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of the Windows Camera Codec Pack. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p><p>The security update addresses the vulnerability by correcting how the Windows Camera Codec Pack handles objects in memory.</p>
Key phrases: run arbitrary code, remote code execution, email attack scenario, web-based attack scenario, convince
CVE-2020-16968: <p>A remote code execution vulnerability exists when the Windows Camera Codec Pack improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p><p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of the Windows Camera Codec Pack. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p><p>The security update addresses the vulnerability by correcting how the Windows Camera Codec Pack handles objects in memory.</p>
Key phrases: run arbitrary code, remote code execution, email attack scenario, web-based attack scenario, convince
CVE-2020-16969: <p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p><p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p><p>The security update corrects the way that Exchange handles these token validations.</p>
Key phrases: gain further information, information disclosure, callback vector
CVE-2020-1697: It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.
Key phrases: trick users in other realms, stored xss
CVE-2020-16970: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
Key phrases: unsigned code execution
CVE-2020-16971: Azure SDK for Java Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2020-16972: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-16973: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-16974: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-16975: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-16976: <p>An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.</p><p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p><p>The security update addresses the vulnerability by correcting how the Windows Backup Service handles file operations.</p>
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-16977: <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p><p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>
Key phrases: run arbitrary code, remote code execution, convince
CVE-2020-16978: <p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p><p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p><p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>
Key phrases: read content that the attacker is not authorized, cross site scripting, cross-site scripting
CVE-2020-16979: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017.
Key phrases: microsoft sharepoint information disclosure
CVE-2020-1698: A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.
Key phrases: data confidentiality
CVE-2020-16980: <p>An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p><p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p><p>The security update addresses the vulnerability by ensuring the Windows iSCSI Target Service properly handles file operations.</p>
Key phrases: gain elevated privileges.</p><p, elevation of privilege, elevation privilege, code execution
CVE-2020-16981: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16988, CVE-2020-16989, CVE-2020-16992, CVE-2020-16993.
Key phrases: elevation of privilege
CVE-2020-16982: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
Key phrases: unsigned code execution
CVE-2020-16983: Azure Sphere Tampering Vulnerability
Key phrases: tampering
CVE-2020-16984: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
Key phrases: unsigned code execution
CVE-2020-16985: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16990.
Key phrases: azure sphere information disclosure
CVE-2020-16986: Azure Sphere Denial of Service Vulnerability
Key phrases: azure sphere denial of service
CVE-2020-16987: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16991, CVE-2020-16994.
Key phrases: unsigned code execution
CVE-2020-16988: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16981, CVE-2020-16989, CVE-2020-16992, CVE-2020-16993.
Key phrases: elevation of privilege
CVE-2020-16989: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16981, CVE-2020-16988, CVE-2020-16992, CVE-2020-16993.
Key phrases: elevation of privilege
CVE-2020-1699: A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
Key phrases: path traversal flaw, information disclosure
CVE-2020-16990: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16985.
Key phrases: azure sphere information disclosure
CVE-2020-16991: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16994.
Key phrases: unsigned code execution
CVE-2020-16992: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16981, CVE-2020-16988, CVE-2020-16989, CVE-2020-16993.
Key phrases: elevation of privilege
CVE-2020-16993: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16981, CVE-2020-16988, CVE-2020-16989, CVE-2020-16992.
Key phrases: elevation of privilege
CVE-2020-16994: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991.
Key phrases: unsigned code execution
CVE-2020-16995: <p>An elevation of privilege vulnerability exists in Network Watcher Agent virtual machine extension for Linux. An attacker who successfully exploited this vulnerability could execute code with elevated privileges.</p><p>To exploit this vulnerability, an attacker would have to be present as a user on the affected virtual machine.</p><p>The security update addresses this vulnerability by correcting how Network Watcher Agent virtual machine extension for Linux executes with elevated privileges.</p>
Key phrases: elevation of privilege, elevation privilege, execute code
CVE-2020-16996: Kerberos Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, kerberos security feature bypass
CVE-2020-16997: Remote Desktop Protocol Server Information Disclosure Vulnerability
Key phrases: remote desktop protocol server information disclosure
CVE-2020-16998: DirectX Elevation of Privilege Vulnerability
Key phrases: directx elevation of privilege
CVE-2020-16999: Windows WalletService Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-1700: A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Key phrases: permanent leak, denial of service condition, exhaustion of available resources
CVE-2020-17000: Remote Desktop Protocol Client Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17001: Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17014.
Key phrases: windows print spooler elevation of privilege
CVE-2020-17002: Azure SDK for C Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2020-17003: <p>A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.</p><p>An attacker who successfully exploited the vulnerability would gain execution on a victim system.</p><p>The security update addresses the vulnerability by correcting how the Base3D rendering engine handles memory.</p>
Key phrases: gain execution, remote code execution
CVE-2020-17004: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17005: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability This CVE ID is unique from CVE-2020-17006, CVE-2020-17018, CVE-2020-17021.
Key phrases: cross-site scripting
CVE-2020-17006: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability This CVE ID is unique from CVE-2020-17005, CVE-2020-17018, CVE-2020-17021.
Key phrases: cross-site scripting
CVE-2020-17007: Windows Error Reporting Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-1701: A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.
Key phrases: read the contents of that secret
CVE-2020-17010: Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17038.
Key phrases: elevation of privilege
CVE-2020-17011: Windows Port Class Library Elevation of Privilege Vulnerability
Key phrases: windows port class library elevation of privilege
CVE-2020-17012: Windows Bind Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows bind filter driver elevation of privilege
CVE-2020-17013: Win32k Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17014: Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17001.
Key phrases: windows print spooler elevation of privilege
CVE-2020-17015: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060.
Key phrases: spoofing
CVE-2020-17016: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060.
Key phrases: spoofing
CVE-2020-17017: Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979.
Key phrases: microsoft sharepoint information disclosure
CVE-2020-17018: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability This CVE ID is unique from CVE-2020-17005, CVE-2020-17006, CVE-2020-17021.
Key phrases: cross-site scripting
CVE-2020-17019: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17064, CVE-2020-17065, CVE-2020-17066.
Key phrases: remote code execution
CVE-2020-1702: A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
Key phrases: crash
CVE-2020-17020: Microsoft Word Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2020-17021: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability This CVE ID is unique from CVE-2020-17005, CVE-2020-17006, CVE-2020-17018.
Key phrases: cross-site scripting
CVE-2020-17022: <p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code.</p><p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p><p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>
Key phrases: execute arbitrary code.</p><p, remote code execution
CVE-2020-17023: <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p><p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>
Key phrases: run arbitrary code, remote code execution, convince
CVE-2020-17024: Windows Client Side Rendering Print Provider Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-17025: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17026: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17027: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17028: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17029: Windows Canonical Display Driver Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17030: Windows MSCTF Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17031: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17032: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17033: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17034: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17043, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17035: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2020-17036: Windows Function Discovery SSDP Provider Information Disclosure Vulnerability
Key phrases: windows function discovery ssdp provider information disclosure
CVE-2020-17037: Windows WalletService Elevation of Privilege Vulnerability
Key phrases: windows walletservice elevation of privilege
CVE-2020-17038: Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17010.
Key phrases: elevation of privilege
CVE-2020-1704: An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Key phrases: insecure modification, escalate privilege
CVE-2020-17040: Windows Hyper-V Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows hyper-v security feature bypass
CVE-2020-17041: Windows Print Configuration Elevation of Privilege Vulnerability
Key phrases: windows print configuration elevation of privilege
CVE-2020-17042: Windows Print Spooler Remote Code Execution Vulnerability
Key phrases: windows print spooler remote code execution
CVE-2020-17043: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17044, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17044: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17055.
Key phrases: windows remote access elevation of privilege
CVE-2020-17045: Windows KernelStream Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17046: Windows Error Reporting Denial of Service Vulnerability
Key phrases: denial of service
CVE-2020-17047: Windows Network File System Denial of Service Vulnerability
Key phrases: windows network file system denial of service
CVE-2020-17048: Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17054.
Key phrases: chakra scripting engine memory corruption
CVE-2020-17049: Kerberos Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, kerberos security feature bypass
CVE-2020-1705: A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/template-service-broker-operator. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Key phrases: insecure modification, escalate their privileges, escalate privilege
CVE-2020-17051: Windows Network File System Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17052: Scripting Engine Memory Corruption Vulnerability
Key phrases: memory corruption
CVE-2020-17053: Internet Explorer Memory Corruption Vulnerability
Key phrases: internet explorer memory corruption
CVE-2020-17054: Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17048.
Key phrases: chakra scripting engine memory corruption
CVE-2020-17055: Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025, CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034, CVE-2020-17043, CVE-2020-17044.
Key phrases: windows remote access elevation of privilege
CVE-2020-17056: Windows Network File System Information Disclosure Vulnerability
Key phrases: windows network file system information disclosure
CVE-2020-17057: Windows Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-17058: Microsoft Browser Memory Corruption Vulnerability
Key phrases: microsoft browser memory corruption
CVE-2020-1706: It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.
Key phrases: escalate privilege
CVE-2020-17060: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016.
Key phrases: spoofing
CVE-2020-17061: Microsoft SharePoint Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17062: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17063: Microsoft Office Online Spoofing Vulnerability
Key phrases: spoofing
CVE-2020-17064: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17019, CVE-2020-17065, CVE-2020-17066.
Key phrases: remote code execution
CVE-2020-17065: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17019, CVE-2020-17064, CVE-2020-17066.
Key phrases: remote code execution
CVE-2020-17066: Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17019, CVE-2020-17064, CVE-2020-17065.
Key phrases: remote code execution
CVE-2020-17067: Microsoft Excel Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, microsoft excel security feature bypass
CVE-2020-17068: Windows GDI+ Remote Code Execution Vulnerability
Key phrases: windows gdi+ remote code execution
CVE-2020-17069: Windows NDIS Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-1707: A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Key phrases: insecure modification, escalate their privileges, escalate privilege
CVE-2020-17070: Windows Update Medic Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-17071: Windows Delivery Optimization Information Disclosure Vulnerability
Key phrases: windows delivery optimization information disclosure
CVE-2020-17073: Windows Update Orchestrator Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17074, CVE-2020-17076.
Key phrases: windows update orchestrator service elevation of privilege
CVE-2020-17074: Windows Update Orchestrator Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17073, CVE-2020-17076.
Key phrases: windows update orchestrator service elevation of privilege
CVE-2020-17075: Windows USO Core Worker Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-17076: Windows Update Orchestrator Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17073, CVE-2020-17074.
Key phrases: windows update orchestrator service elevation of privilege
CVE-2020-17077: Windows Update Stack Elevation of Privilege Vulnerability
Key phrases: windows update stack elevation of privilege
CVE-2020-17078: Raw Image Extension Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17079, CVE-2020-17082, CVE-2020-17086.
Key phrases: remote code execution
CVE-2020-17079: Raw Image Extension Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17078, CVE-2020-17082, CVE-2020-17086.
Key phrases: remote code execution
CVE-2020-1708: It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/mysql-apb.
Key phrases: escalate privilege
CVE-2020-17081: Microsoft Raw Image Extension Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17082: Raw Image Extension Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17078, CVE-2020-17079, CVE-2020-17086.
Key phrases: remote code execution
CVE-2020-17083: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17084.
Key phrases: microsoft exchange server remote code execution
CVE-2020-17084: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17083.
Key phrases: microsoft exchange server remote code execution
CVE-2020-17085: Microsoft Exchange Server Denial of Service Vulnerability
Key phrases: denial of service
CVE-2020-17086: Raw Image Extension Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17078, CVE-2020-17079, CVE-2020-17082.
Key phrases: remote code execution
CVE-2020-17087: Windows Kernel Local Elevation of Privilege Vulnerability
Key phrases: windows kernel local elevation of privilege
CVE-2020-17088: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2020-17089: Microsoft SharePoint Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-1709: A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Key phrases: insecure modification, escalate their privileges, escalate privilege
CVE-2020-17090: Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, feature bypass
CVE-2020-17091: Microsoft Teams Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17092: Windows Network Connections Service Elevation of Privilege Vulnerability
Key phrases: service elevation of privilege
CVE-2020-17094: Windows Error Reporting Information Disclosure Vulnerability
Key phrases: windows error reporting information disclosure
CVE-2020-17095: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17096: Windows NTFS Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17097: Windows Digital Media Receiver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2020-17098: Windows GDI+ Information Disclosure Vulnerability
Key phrases: windows gdi+ information disclosure
CVE-2020-17099: Windows Lock Screen Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows lock screen security feature bypass
CVE-2020-1710: The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
CVE-2020-17100: Visual Studio Tampering Vulnerability
Key phrases: tampering
CVE-2020-17101: HEIF Image Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17102: WebP Image Extensions Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17103: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2020-17104: Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17105: AV1 Video Extension Remote Code Execution Vulnerability
Key phrases: video extension remote code execution
CVE-2020-17106: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17107, CVE-2020-17108, CVE-2020-17109, CVE-2020-17110.
Key phrases: hevc video extensions remote code execution
CVE-2020-17107: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106, CVE-2020-17108, CVE-2020-17109, CVE-2020-17110.
Key phrases: hevc video extensions remote code execution
CVE-2020-17108: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106, CVE-2020-17107, CVE-2020-17109, CVE-2020-17110.
Key phrases: hevc video extensions remote code execution
CVE-2020-17109: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106, CVE-2020-17107, CVE-2020-17108, CVE-2020-17110.
Key phrases: hevc video extensions remote code execution
CVE-2020-1711: An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
Key phrases: out-of-bounds heap buffer access flaw, denial of service, crash, arbitrary code
CVE-2020-17110: HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106, CVE-2020-17107, CVE-2020-17108, CVE-2020-17109.
Key phrases: hevc video extensions remote code execution
CVE-2020-17113: Windows Camera Codec Information Disclosure Vulnerability
Key phrases: windows camera codec information disclosure
CVE-2020-17115: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: microsoft sharepoint server spoofing
CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2020-17118: Microsoft SharePoint Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17119: Microsoft Outlook Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-1712: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
Key phrases: heap use-after-free, crash systemd services, use after free, execute code, elevate privileges
CVE-2020-17120: Microsoft SharePoint Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17121: Microsoft SharePoint Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17122: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17123: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17124: Microsoft PowerPoint Remote Code Execution Vulnerability
Key phrases: microsoft powerpoint remote code execution
CVE-2020-17125: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17126: Microsoft Excel Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17127: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17128: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17129: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2020-17130: Microsoft Excel Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, microsoft excel security feature bypass
CVE-2020-17131: Chakra Scripting Engine Memory Corruption Vulnerability
Key phrases: memory corruption
CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2020-17133: Microsoft Dynamics Business Central/NAV Information Disclosure
Key phrases: information disclosure
CVE-2020-17134: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2020-17135: Azure DevOps Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2020-17136: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2020-17137: DirectX Graphics Kernel Elevation of Privilege Vulnerability
Key phrases: directx graphics kernel elevation of privilege
CVE-2020-17138: Windows Error Reporting Information Disclosure Vulnerability
Key phrases: windows error reporting information disclosure
CVE-2020-17139: Windows Overlay Filter Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows overlay filter security feature bypass
CVE-2020-1714: A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Key phrases: inject arbitrarily serialized Java Objects, remote code execution
CVE-2020-17140: Windows SMB Information Disclosure Vulnerability
Key phrases: windows smb information disclosure
CVE-2020-17141: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2020-17143: Microsoft Exchange Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2020-17144: Microsoft Exchange Remote Code Execution Vulnerability
Key phrases: microsoft exchange remote code execution
CVE-2020-17145: Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
Key phrases: spoofing
CVE-2020-17147: Dynamics CRM Webclient Cross-site Scripting Vulnerability
Key phrases: cross-site scripting
CVE-2020-17148: Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17150: Visual Studio Code Remote Code Execution Vulnerability
Key phrases: visual studio code remote code execution
CVE-2020-17152: Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17153: Microsoft Edge for Android Spoofing Vulnerability
Key phrases: spoofing
CVE-2020-17156: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17158: Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-17159: Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-1716: A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Key phrases: gain administrator access, brute-force ceph deployments, hardcoded, hardcoded password, default password
CVE-2020-17162: Microsoft Windows Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, microsoft windows security feature bypass
CVE-2020-17163: Visual Studio Code Python Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2020-1717: A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
Key phrases: account email enumeration
CVE-2020-1718: A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
Key phrases: gain unauthorized access, gain unauthorized access to the application
CVE-2020-1719: A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
Key phrases: confidentiality, confidentiality and integrity
CVE-2020-1720: A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
Key phrases: certain configurations, database corruption
CVE-2020-1721: A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
Key phrases: cross-site scripting (xss)
CVE-2020-1722: A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.
Key phrases: denial of service, system availability
CVE-2020-1723: A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0
CVE-2020-1724: A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.
Key phrases: see the personal information of a previously logged
CVE-2020-1725: A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.
CVE-2020-1726: A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
Key phrases: overwrite existing files in volumes
CVE-2020-1727: A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients.
Key phrases: craft deep links that introduce further attack scenarios
CVE-2020-1728: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
Key phrases: clickjacking, channel downgrade, client-based attack vectors
CVE-2020-1729: A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Key phrases: obtain the ClassLoader, bypassing any permissions, potentially obtain the ClassLoader, confidentiality