Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 05:03Z
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1126 — Microsoft Windows_10: A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1126

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage. The security update addr CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile

CWECWE 787VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1118 — Microsoft Windows_10: A denial of service vulnerability exists in the Windows implementation of Transport Layer Security

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1118

A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, a remote unauthenticated attacker could send a specially crafted request to a target system utilizing TLS 1.2 or lower, triggering the system to automatically reboot. The update addresses t CVSSv3.1 8.6 (HIGH) · EPSS 97th percentile

VNDMicrosoftTYPVulnerability
8.6
CVSS v3.1
98
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1117 — Microsoft Windows_10: A remote code execution vulnerability exists in the way that the Color Management Module

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1117

A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with adminis CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1112 — Microsoft Windows_10: An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1112

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content. An attacker who successfully exploited this vulnerability could upload restricted file types to an IIS-hosted folder. To exploit this vulnerability, an attacker would require permissions to upload files via BITS. An attacker could then submit a specially crafted request to upload a file. The security update addresses th CVSSv3.1 8.5 (HIGH) · EPSS 89th percentile

CWECWE 434VNDMicrosoftTYPVulnerability
8.5
CVSS v3.1
94
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1108 — Microsoft .net: A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1108

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core or .NET Framework application. The up CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile

VNDMicrosoftTYPVulnerability
7.5
CVSS v3.1
91
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1102 — Microsoft Sharepoint_enterprise_server: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1102

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The secu CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 434VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
99
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1069 — Microsoft Sharepoint_enterprise_server: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1069

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 476VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
728 × 90 / responsive · programmatic ad slot
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1062 — Microsoft Internet_explorer: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1062

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An atta CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile

CWECWE 787VNDMicrosoftTYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1061 — Microsoft Windows_10: A remote code execution vulnerability exists in the way that the Microsoft Script Runtime

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1061

A remote code execution vulnerability exists in the way that the Microsoft Script Runtime handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerabi CVSSv3.1 7.5 (HIGH) · EPSS 95th percentile

CWECWE 787VNDMicrosoftTYPVulnerability
7.5
CVSS v3.1
91
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1054 — Microsoft Windows_10_1507: An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1054in the wild

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially cr CVSSv3.1 7.0 (HIGH) · EPSS 99th percentile

CWECWE 787VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.0
CVSS v3.1
100
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1051 — Microsoft Windows_10: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1051

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file. The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory. CVSSv3.1 7.8 (HIGH) · EPSS 95th percentile

VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
92
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1048 — Microsoft Windows_10: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1048

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially CVSSv3.1 7.8 (HIGH) · EPSS 97th percentile

CWECWE 669VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
94
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1024 — Microsoft Sharepoint_enterprise_server: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1024

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The secu CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 434VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2020-05-21
2020-05-21 23:15Z
HIGH

CVE-2020-1023 — Microsoft Sharepoint_enterprise_server: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1023

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account. Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The secu CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 434VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2020-05-21
2020-05-21 23:15Z
CRIT

CVE-2020-0901 — Microsoft 365_apps: A remote code execution vulnerability exists in Microsoft Excel software when the software fails

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-0901

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full us CVSSv3.1 9.8 (CRITICAL) · EPSS 96th percentile

VNDMicrosoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-05-20
2020-05-20 19:15Z
HIGH

CVE-2020-9484 — Apache Tomcat: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9484

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided o CVSSv3.1 7.0 (HIGH) · EPSS 99th percentile

CWECWE 502VNDApacheTYPVulnerability
7.0
CVSS v3.1
100
Edit Score
2020-05-06
2020-05-06 17:15Z
HIGH

CVE-2020-3283 — Cisco Secure_firewall_threat_defense: A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3283

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the Cisco Firepower 1000 Series platform could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a communication error between internal functions. An attacker could exploit this vulnerability by sending a crafted SSL/TLS message to an a CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile

CWECWE 787CWECWE 119VNDCiscoVNDSecureTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-05-06
2020-05-06 17:15Z
HIGH

CVE-2020-3259 — Cisco Secure_firewall_threat_defense: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3259in the wild

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit t CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 200VNDCiscoTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2020-05-06
2020-05-06 17:15Z
HIGH

CVE-2020-3196 — Cisco Secure_firewall_threat_defense: A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3196

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a denial of service (DoS) condition. The vulnerability is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this vulnerability by est CVSSv3.1 8.6 (HIGH) · EPSS 80th percentile

CWECWE 400VNDCiscoVNDSecureTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-05-06
2020-05-06 17:15Z
HIGH

CVE-2020-3191 — Cisco Secure_firewall_threat_defense: A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3191

A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper length validation of a field in an IPv6 DNS packet. An attacker could exploit this vulnerability by sending a crafted DNS query over IPv6, which traverse CVSSv3.1 8.6 (HIGH) · EPSS 77th percentile

CWECWE 20VNDCiscoVNDDnsTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-05-06
2020-05-06 17:15Z
HIGH

CVE-2020-3189 — Cisco Secure_firewall_threat_defense: A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3189

A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak that can deplete system memory over time, which can cause unexpected system behaviors or device crashes. The vulnerability is due to the system memory not being properly freed for a VPN System Logging event generated when a VPN session is created or deleted. An attacker could exploit this vulnerability CVSSv3.1 8.6 (HIGH) · EPSS 76th percentile

CWECWE 400CWECWE 401VNDCiscoVNDVpnTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-05-06
2020-05-06 17:15Z
CRIT

CVE-2020-3187 — Cisco Secure_firewall_threat_defense: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3187

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing d CVSSv3.1 9.1 (CRITICAL) · EPSS 100th percentile

CWECWE 22VNDCiscoTYPVulnerability
9.1
CVSS v3.1
100
Edit Score
2020-05-01
2020-05-01 19:15Z
CRIT

CVE-2020-10683 — Dom4j_project Dom4j: before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 611VNDOracleVNDDom4j ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-04-22
2020-04-22 19:15Z
CRIT

CVE-2020-7489 — Schneider-electric Ecostruxure_machine_expert: A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-7489

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller. CVSSv3.1 9.8 (CRITICAL) · EPSS 71th percentile

CWECWE 74VNDSchneider ElectricVNDCweTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2020-04-21
2020-04-21 14:15Z
HIGH

CVE-2020-1967 — Openssl Openssl: Server or client applications that call the SSL_check_chain() function during or after a TLS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 476VNDOpensslTYPVulnerability
7.5
CVSS v3.1
100
Edit Score