# CVEs published 2020-07-14

193 CVEs were published on July 14, 2020: 4 critical, 6 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2020-1469](https://cve.now/CVE-2020-1469.md): A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerabi (no CVSS, Microsoft Bond · Bond.Core.CSharp)
- [CVE-2020-1481](https://cve.now/CVE-2020-1481.md): A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a pr (no CVSS, Microsoft Visual Studio Code ESLint extension)
- [CVE-2020-1463](https://cve.now/CVE-2020-1463.md): An elevation of privilege vulnerability exists in the way that the SharedStream Library handles objects in memory, aka 'Windows SharedStream (no CVSS, Microsoft Windows)
- [CVE-2020-1465](https://cve.now/CVE-2020-1465.md): An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulnera (no CVSS, Microsoft OneDrive for Windows)
- [CVE-2020-1468](https://cve.now/CVE-2020-1468.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2020-1461](https://cve.now/CVE-2020-1461.md): An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit th (no CVSS, Microsoft Forefront Endpoint Protection · Microsoft Syst… +2)
- [CVE-2020-1462](https://cve.now/CVE-2020-1462.md): An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Busin (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows)
- [CVE-2020-1456](https://cve.now/CVE-2020-1456.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2020-1458](https://cve.now/CVE-2020-1458.md): A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL) file (no CVSS, Microsoft 365 Apps for Enterprise for 32-bit Systems · Micr…)
- [CVE-2020-1451](https://cve.now/CVE-2020-1451.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2020-1454](https://cve.now/CVE-2020-1454.md): This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. (CVSS 5.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2020-1449](https://cve.now/CVE-2020-1449.md): A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka (no CVSS, Microsoft Office · Microsoft 365 Apps for Enterprise for… +2)
- [CVE-2020-1450](https://cve.now/CVE-2020-1450.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2020-1447](https://cve.now/CVE-2020-1447.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +4)
- [CVE-2020-1448](https://cve.now/CVE-2020-1448.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-1445](https://cve.now/CVE-2020-1445.md): An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +4)
- [CVE-2020-1446](https://cve.now/CVE-2020-1446.md): A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +4)
- [CVE-2020-1443](https://cve.now/CVE-2020-1443.md): A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2020-1444](https://cve.now/CVE-2020-1444.md): A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'Microsof (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2020-1438](https://cve.now/CVE-2020-1438.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-1439](https://cve.now/CVE-2020-1439.md): A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2020-1442](https://cve.now/CVE-2020-1442.md): A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps (no CVSS, Microsoft Office Online Server · Microsoft Office Web Apps)
- [CVE-2020-1436](https://cve.now/CVE-2020-1436.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except (no CVSS, Microsoft Windows)
- [CVE-2020-1437](https://cve.now/CVE-2020-1437.md): An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka (no CVSS, Microsoft Windows)
- [CVE-2020-1434](https://cve.now/CVE-2020-1434.md): An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync Ho (no CVSS, Microsoft Windows)
- [CVE-2020-1435](https://cve.now/CVE-2020-1435.md): A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka (no CVSS, Microsoft Windows)
- [CVE-2020-1432](https://cve.now/CVE-2020-1432.md): An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Intern (no CVSS, Microsoft Internet Explorer 11 on Windows · Microsoft Inter…)
- [CVE-2020-1433](https://cve.now/CVE-2020-1433.md): An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows)
- [CVE-2020-1430](https://cve.now/CVE-2020-1430.md): An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit this vulnerability, an (no CVSS, Microsoft Windows)
- [CVE-2020-1431](https://cve.now/CVE-2020-1431.md): An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulti (no CVSS, Microsoft Windows)
- [CVE-2020-1428](https://cve.now/CVE-2020-1428.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-1429](https://cve.now/CVE-2020-1429.md): An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error R (no CVSS, Microsoft Windows)
- [CVE-2020-1426](https://cve.now/CVE-2020-1426.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2020-1427](https://cve.now/CVE-2020-1427.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-1422](https://cve.now/CVE-2020-1422.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1423](https://cve.now/CVE-2020-1423.md): An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Lin (no CVSS, Microsoft Windows)
- [CVE-2020-1424](https://cve.now/CVE-2020-1424.md): An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update (no CVSS, Microsoft Windows)
- [CVE-2020-1420](https://cve.now/CVE-2020-1420.md): An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerability (no CVSS, Microsoft Windows)
- [CVE-2020-1421](https://cve.now/CVE-2020-1421.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An atta (no CVSS, Microsoft Windows)
- [CVE-2020-1418](https://cve.now/CVE-2020-1418.md): An elevation of privilege vulnerability exists when the Windows Diagnostics Execution Service fails to properly sanitize input, leading to a (no CVSS, Microsoft Windows)
- [CVE-2020-1419](https://cve.now/CVE-2020-1419.md): An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In (no CVSS, Microsoft Windows)
- [CVE-2020-1415](https://cve.now/CVE-2020-1415.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows Server, · Microsoft Windows)
- [CVE-2020-1416](https://cve.now/CVE-2020-1416.md): An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Stu (no CVSS, Microsoft Visual Studio · Microsoft Azure Storage Explor… +1)
- [CVE-2020-1413](https://cve.now/CVE-2020-1413.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1414](https://cve.now/CVE-2020-1414.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1411](https://cve.now/CVE-2020-1411.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva (no CVSS, Microsoft Windows)
- [CVE-2020-1412](https://cve.now/CVE-2020-1412.md): A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics (no CVSS, Microsoft Windows)
- [CVE-2020-1409](https://cve.now/CVE-2020-1409.md): A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V (no CVSS, Microsoft Windows · Microsoft Office)
- [CVE-2020-1410](https://cve.now/CVE-2020-1410.md): A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability, (no CVSS, Microsoft Windows)
- [CVE-2020-1407](https://cve.now/CVE-2020-1407.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2020-1408](https://cve.now/CVE-2020-1408.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microso (no CVSS, Microsoft Windows)
- [CVE-2020-1404](https://cve.now/CVE-2020-1404.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1405](https://cve.now/CVE-2020-1405.md): An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Wi (no CVSS, Microsoft Windows)
- [CVE-2020-1406](https://cve.now/CVE-2020-1406.md): An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows Netw (no CVSS, Microsoft Windows)
- [CVE-2020-1402](https://cve.now/CVE-2020-1402.md): An elevation of privilege vulnerability exists when the Windows ActiveX Installer Service improperly handles memory.To exploit this vulnerab (no CVSS, Microsoft Windows)
- [CVE-2020-1403](https://cve.now/CVE-2020-1403.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer 11 on Windows · Microsoft Inter…)
- [CVE-2020-1400](https://cve.now/CVE-2020-1400.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2020-1401](https://cve.now/CVE-2020-1401.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2020-1398](https://cve.now/CVE-2020-1398.md): An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly handle Ease of Access dialog.An attacker who succes (no CVSS, Microsoft Windows)
- [CVE-2020-1399](https://cve.now/CVE-2020-1399.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1396](https://cve.now/CVE-2020-1396.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who (no CVSS, Microsoft Windows)
- [CVE-2020-1397](https://cve.now/CVE-2020-1397.md): An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory, aka (no CVSS, Microsoft Windows)
- [CVE-2020-1394](https://cve.now/CVE-2020-1394.md): An elevation of privilege vulnerability exists in the way that the Windows Geolocation Framework handles objects in memory, aka 'Windows Ele (no CVSS, Microsoft Windows)
- [CVE-2020-1395](https://cve.now/CVE-2020-1395.md): An elevation of privilege vulnerability exists in the way that the Windows Speech Brokered API handles objects in memory, aka 'Windows Eleva (no CVSS, Microsoft Windows)
- [CVE-2020-1392](https://cve.now/CVE-2020-1392.md): An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka 'Win (no CVSS, Microsoft Windows)
- [CVE-2020-1393](https://cve.now/CVE-2020-1393.md): An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize input, (no CVSS, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2020-1390](https://cve.now/CVE-2020-1390.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-1391](https://cve.now/CVE-2020-1391.md): An information disclosure vulnerability exists when the Windows Agent Activation Runtime (AarSvc) fails to properly handle objects in memory (no CVSS, Microsoft Windows)
- [CVE-2020-1387](https://cve.now/CVE-2020-1387.md): An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push (no CVSS, Microsoft Windows)
- [CVE-2020-1388](https://cve.now/CVE-2020-1388.md): An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory, aka 'Windows Elevation of Privilege (no CVSS, Microsoft Windows)
- [CVE-2020-1389](https://cve.now/CVE-2020-1389.md): An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In (no CVSS, Microsoft Windows)
- [CVE-2020-1385](https://cve.now/CVE-2020-1385.md): An elevation of privilege vulnerability exists in the way that the Windows Credential Picker handles objects in memory, aka 'Windows Credent (no CVSS, Microsoft Windows)
- [CVE-2020-1386](https://cve.now/CVE-2020-1386.md): An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information, aka (no CVSS, Microsoft Windows)
- [CVE-2020-1382](https://cve.now/CVE-2020-1382.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2020-1384](https://cve.now/CVE-2020-1384.md): An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles (no CVSS, Microsoft Windows)
- [CVE-2020-1375](https://cve.now/CVE-2020-1375.md): An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Pri (no CVSS, Microsoft Windows)
- [CVE-2020-1381](https://cve.now/CVE-2020-1381.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2020-1373](https://cve.now/CVE-2020-1373.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-1374](https://cve.now/CVE-2020-1374.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2020-1371](https://cve.now/CVE-2020-1371.md): An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilit (no CVSS, Microsoft Windows)
- [CVE-2020-1372](https://cve.now/CVE-2020-1372.md): An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles objects in memory, (no CVSS, Microsoft Windows)
- [CVE-2020-1369](https://cve.now/CVE-2020-1369.md): An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi (no CVSS, Microsoft Windows)
- [CVE-2020-1370](https://cve.now/CVE-2020-1370.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1366](https://cve.now/CVE-2020-1366.md): An elevation of privilege vulnerability exists when the Windows Print Workflow Service improperly handles objects in memory, aka 'Windows Pr (no CVSS, Microsoft Windows)
- [CVE-2020-1367](https://cve.now/CVE-2020-1367.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2020-1368](https://cve.now/CVE-2020-1368.md): An elevation of privilege vulnerability exists in the way that the Credential Enrollment Manager service handles objects in memory, aka 'Win (no CVSS, Microsoft Windows)
- [CVE-2020-1364](https://cve.now/CVE-2020-1364.md): A denial of service vulnerability exists in the way that the WalletService handles files, aka 'Windows WalletService Denial of Service Vulne (no CVSS, Microsoft Windows)
- [CVE-2020-1365](https://cve.now/CVE-2020-1365.md): An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilit (no CVSS, Microsoft Windows)
- [CVE-2020-1362](https://cve.now/CVE-2020-1362.md): An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi (no CVSS, Microsoft Windows)
- [CVE-2020-1363](https://cve.now/CVE-2020-1363.md): An elevation of privilege vulnerability exists when the Windows Picker Platform improperly handles memory.To exploit this vulnerability, an (no CVSS, Microsoft Windows)
- [CVE-2020-1360](https://cve.now/CVE-2020-1360.md): An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka 'Windows Profile Ser (no CVSS, Microsoft Windows)
- [CVE-2020-1361](https://cve.now/CVE-2020-1361.md): An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker wo (no CVSS, Microsoft Windows)
- [CVE-2020-1358](https://cve.now/CVE-2020-1358.md): An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To exploit this vulnerab (no CVSS, Microsoft Windows)
- [CVE-2020-1359](https://cve.now/CVE-2020-1359.md): An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles (no CVSS, Microsoft Windows)
- [CVE-2020-1356](https://cve.now/CVE-2020-1356.md): An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations, aka 'Windows iSCSI (no CVSS, Microsoft Windows Server, · Microsoft Windows Server)
- [CVE-2020-1357](https://cve.now/CVE-2020-1357.md): An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations, aka 'Windows System (no CVSS, Microsoft Windows)
- [CVE-2020-1354](https://cve.now/CVE-2020-1354.md): An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit this vulnerability, an (no CVSS, Microsoft Windows)
- [CVE-2020-1355](https://cve.now/CVE-2020-1355.md): A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploi (no CVSS, Microsoft Windows)
- [CVE-2020-1351](https://cve.now/CVE-2020-1351.md): An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka 'Microsoft Grap (no CVSS, Microsoft Windows)
- [CVE-2020-1352](https://cve.now/CVE-2020-1352.md): An elevation of privilege vulnerability exists when the Windows USO Core Worker improperly handles memory.To exploit this vulnerability, an (no CVSS, Microsoft Windows)
- [CVE-2020-1353](https://cve.now/CVE-2020-1353.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1350](https://cve.now/CVE-2020-1350.md): A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows (CVSS 10.0, KEV, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2020-1346](https://cve.now/CVE-2020-1346.md): An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, aka 'Windows Modules I (no CVSS, Microsoft Windows)
- [CVE-2020-1347](https://cve.now/CVE-2020-1347.md): An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka 'Windows Storage Ser (no CVSS, Microsoft Windows)
- [CVE-2020-1342](https://cve.now/CVE-2020-1342.md): An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, wh (no CVSS, Microsoft SharePoint Enterprise Server · Microsoft Share… +4)
- [CVE-2020-1344](https://cve.now/CVE-2020-1344.md): An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi (no CVSS, Microsoft Windows)
- [CVE-2020-1333](https://cve.now/CVE-2020-1333.md): An elevation of privilege vulnerability exists when Group Policy Services Policy Processing improperly handle reparse points, aka 'Group Pol (no CVSS, Microsoft Windows)
- [CVE-2020-1336](https://cve.now/CVE-2020-1336.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-1326](https://cve.now/CVE-2020-1326.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps (no CVSS, Microsoft Azure DevOps Server)
- [CVE-2020-1330](https://cve.now/CVE-2020-1330.md): An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Wi (no CVSS, Microsoft Windows Server, · Microsoft Windows)
- [CVE-2020-1249](https://cve.now/CVE-2020-1249.md): An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation (no CVSS, Microsoft Windows)
- [CVE-2020-1267](https://cve.now/CVE-2020-1267.md): This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated att (no CVSS, Microsoft Windows)
- [CVE-2020-1147](https://cve.now/CVE-2020-1147.md): A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the (CVSS 7.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft Shar… +21)
- [CVE-2020-1240](https://cve.now/CVE-2020-1240.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft 365 Apps for Enterprise for 32-bit Systems · Micr…)
- [CVE-2020-1042](https://cve.now/CVE-2020-1042.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (no CVSS, Microsoft Windows Server)
- [CVE-2020-1043](https://cve.now/CVE-2020-1043.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (no CVSS, Microsoft Windows Server)
- [CVE-2020-1085](https://cve.now/CVE-2020-1085.md): An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory, aka 'Window (no CVSS, Microsoft Windows)
- [CVE-2020-1040](https://cve.now/CVE-2020-1040.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (CVSS 9.0, KEV, Microsoft Windows Server)
- [CVE-2020-1041](https://cve.now/CVE-2020-1041.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (no CVSS, Microsoft Windows Server)
- [CVE-2020-1032](https://cve.now/CVE-2020-1032.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (no CVSS, Microsoft Windows Server)
- [CVE-2020-1036](https://cve.now/CVE-2020-1036.md): A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authentica (no CVSS, Microsoft Windows Server)
- [CVE-2020-1025](https://cve.now/CVE-2020-1025.md): Microsoft Office Elevation of Privilege Vulnerability (no CVSS, Microsoft Skype for Business Server 2019 CU2 · Microsof… +4)
- [CVE-2020-15104](https://cve.now/CVE-2020-15104.md): TLS Validation Vulnerability in Envoy (CVSS 4.6, envoyproxy envoy)
- [CVE-2020-15101](https://cve.now/CVE-2020-15101.md): Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs (CVSS 2.8, schokokeksorg freewvs · freewvs)
- [CVE-2020-11084](https://cve.now/CVE-2020-11084.md): Command Injection in iPear (CVSS 6.4, yaBobJonez iPear)
- [CVE-2020-11083](https://cve.now/CVE-2020-11083.md): Stored XSS in October (CVSS 3.5, October CMS October · october/backend)
- [CVE-2020-5246](https://cve.now/CVE-2020-5246.md): LDAP injection vulnerability in Traccar GPS Tracking System (CVSS 7.7, Traccar)
- [CVE-2020-5374](https://cve.now/CVE-2020-5374.md): Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded crypto (CVSS 8.8, Dell OMIMSSC)
- [CVE-2020-5373](https://cve.now/CVE-2020-5373.md): Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authent (CVSS 6.5, Dell OMIMSSC)
- [CVE-2019-12773](https://cve.now/CVE-2019-12773.md): An issue was discovered in Verint Impact 360 15.1. (no CVSS)
- [CVE-2019-12784](https://cve.now/CVE-2019-12784.md): An issue was discovered in Verint Impact 360 15.1. (no CVSS)
- [CVE-2019-12783](https://cve.now/CVE-2019-12783.md): An issue was discovered in Verint Impact 360 15.1. (no CVSS)
- [CVE-2020-11546](https://cve.now/CVE-2020-11546.md): SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. (no CVSS)
- [CVE-2020-15100](https://cve.now/CVE-2020-15100.md): Uncontrolled Resource Consumption in freewvs (CVSS 2.8, schokokeksorg freewvs · freewvs)
- [CVE-2020-9297](https://cve.now/CVE-2020-9297.md): Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. (no CVSS, Netflix Titus)
- [CVE-2020-13846](https://cve.now/CVE-2020-13846.md): Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code. (no CVSS, github.com/sylabs/singularity)
- [CVE-2020-15074](https://cve.now/CVE-2020-15074.md): OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens (no CVSS, OpenVPN Access Server)
- [CVE-2020-13845](https://cve.now/CVE-2020-13845.md): Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. (no CVSS, github.com/sylabs/singularity)
- [CVE-2020-13847](https://cve.now/CVE-2020-13847.md): Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. (no CVSS)
- [CVE-2020-11827](https://cve.now/CVE-2020-11827.md): In GOG Galaxy 1.2.67, there is a service that is vulnerable to weak file/service permissions: GalaxyClientService.exe. (no CVSS)
- [CVE-2020-13935](https://cve.now/CVE-2020-13935.md): The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8. (no CVSS, Apache Tomcat · tomcat +3)
- [CVE-2020-13934](https://cve.now/CVE-2020-13934.md): An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 proces (no CVSS, Apache Tomcat · tomcat +2)
- [CVE-2020-15721](https://cve.now/CVE-2020-15721.md): RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php. (no CVSS, francoisjacquet/rosariosis)
- [CVE-2020-15719](https://cve.now/CVE-2020-15719.md): libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support (no CVSS)
- [CVE-2020-15720](https://cve.now/CVE-2020-15720.md): In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. (no CVSS)
- [CVE-2020-10041](https://cve.now/CVE-2020-10041.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10042](https://cve.now/CVE-2020-10042.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10043](https://cve.now/CVE-2020-10043.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10044](https://cve.now/CVE-2020-10044.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10045](https://cve.now/CVE-2020-10045.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-7576](https://cve.now/CVE-2020-7576.md): A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions \< V8.2), Opcenter E (no CVSS, Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…)
- [CVE-2020-7577](https://cve.now/CVE-2020-7577.md): A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions \< V8.2). (no CVSS, Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…)
- [CVE-2020-7578](https://cve.now/CVE-2020-7578.md): A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions \< V8.2). (no CVSS, Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…)
- [CVE-2020-7581](https://cve.now/CVE-2020-7581.md): A vulnerability has been identified in Opcenter Execution Discrete (All versions \< V3.2), Opcenter Execution Foundation (All versions \< V3.2 (no CVSS, Siemens Opcenter Execution Discrete · Siemens Opcenter E… +9)
- [CVE-2020-7584](https://cve.now/CVE-2020-7584.md): A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions \>= V2.2 \< V2.5.1). (no CVSS, Siemens AG SIMATIC S7-200 SMART CPU family)
- [CVE-2020-7587](https://cve.now/CVE-2020-7587.md): A vulnerability has been identified in Opcenter Execution Discrete (All versions \< V3.2), Opcenter Execution Foundation (All versions \< V3.2 (no CVSS, Siemens Opcenter Execution Discrete · Siemens Opcenter… +11)
- [CVE-2020-7588](https://cve.now/CVE-2020-7588.md): A vulnerability has been identified in Opcenter Execution Discrete (All versions \< V3.2), Opcenter Execution Foundation (All versions \< V3.2 (no CVSS, Siemens Opcenter Execution Discrete · Siemens Opcenter… +11)
- [CVE-2020-7592](https://cve.now/CVE-2020-7592.md): A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. (no CVSS, Siemens AG SIMATIC HMI Basic Panels 1st Generation · Sie… +4)
- [CVE-2020-7593](https://cve.now/CVE-2020-7593.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens AG LOGO! 8 BM)
- [CVE-2020-10037](https://cve.now/CVE-2020-10037.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10038](https://cve.now/CVE-2020-10038.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10039](https://cve.now/CVE-2020-10039.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-10040](https://cve.now/CVE-2020-10040.md): A vulnerability has been identified in SICAM MMU (All versions \< V2.05), SICAM SGU (All versions), SICAM T (All versions \< V2.18). (no CVSS, Siemens AG SICAM MMU · Siemens AG SICAM SGU +1)
- [CVE-2020-1948](https://cve.now/CVE-2020-1948.md): This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. (no CVSS, Apache Dubbo · org.apache.dubbo:dubbo +1)
- [CVE-2020-4513](https://cve.now/CVE-2020-4513.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 6.1, IBM QRadar SIEM)
- [CVE-2020-4512](https://cve.now/CVE-2020-4512.md): IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands. (CVSS 9.1, IBM QRadar SIEM)
- [CVE-2020-4511](https://cve.now/CVE-2020-4511.md): IBM QRadar SIEM 7.3 and 7.4 could allow an authenticated user to cause a denial of service of the qflow process by sending a malformed sflow (CVSS 6.5, IBM QRadar SIEM)
- [CVE-2020-4510](https://cve.now/CVE-2020-4510.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.6, IBM QRadar SIEM)
- [CVE-2020-4364](https://cve.now/CVE-2020-4364.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2020-13753](https://cve.now/CVE-2020-13753.md): The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE\_NEWUSER and the TIOCSTI ioctl. (no CVSS)
- [CVE-2020-11956](https://cve.now/CVE-2020-11956.md): An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. (no CVSS)
- [CVE-2020-11955](https://cve.now/CVE-2020-11955.md): An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. (no CVSS)
- [CVE-2020-11953](https://cve.now/CVE-2020-11953.md): An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70\_4 devices. (no CVSS)
- [CVE-2020-11952](https://cve.now/CVE-2020-11952.md): An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. (no CVSS)
- [CVE-2020-11951](https://cve.now/CVE-2020-11951.md): An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. (no CVSS)
- [CVE-2020-13926](https://cve.now/CVE-2020-13926.md): Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configura (no CVSS, Apache Kylin · org.apache.kylin:kylin-server-base)
- [CVE-2020-13925](https://cve.now/CVE-2020-13925.md): Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the se (no CVSS, Apache Kylin · org.apache.kylin:kylin-server-base)
- [CVE-2020-12025](https://cve.now/CVE-2020-12025.md): Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, wh (no CVSS, Rockwell Automation Logix Designer Studio 5000 Versions 32.…)
- [CVE-2020-6267](https://cve.now/CVE-2020-6267.md): Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only (CVSS 6.3, SAP SE SAP Disclosure Management)
- [CVE-2020-6276](https://cve.now/CVE-2020-6276.md): SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting (CVSS 6.1, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6278](https://cve.now/CVE-2020-6278.md): SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scri (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6280](https://cve.now/CVE-2020-6280.md): SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files whic (CVSS 2.7, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6281](https://cve.now/CVE-2020-6281.md): SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, result (CVSS 6.1, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6282](https://cve.now/CVE-2020-6282.md): SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP servic (CVSS 5.8, SAP SE SAP NetWeaver AS JAVA (IIOP service))
- [CVE-2020-6285](https://cve.now/CVE-2020-6285.md): SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an at (CVSS 7.7, SAP SE SAP NetWeaver - XML Toolkit for JAVA)
- [CVE-2020-6286](https://cve.now/CVE-2020-6286.md): The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions (CVSS 5.3, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6287](https://cve.now/CVE-2020-6287.md): SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an (CVSS 10.0, KEV, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6289](https://cve.now/CVE-2020-6289.md): SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user i (CVSS 4.3, SAP SE SAP Disclosure Management)
- [CVE-2020-6290](https://cve.now/CVE-2020-6290.md): SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specifi (CVSS 4.2, SAP SE SAP Disclosure Management)
- [CVE-2020-6291](https://cve.now/CVE-2020-6291.md): SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authent (CVSS 5.4, SAP SE SAP Disclosure Management)
- [CVE-2020-6292](https://cve.now/CVE-2020-6292.md): Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session (CVSS 4.6, SAP SE SAP Disclosure Management)
- [CVE-2020-15711](https://cve.now/CVE-2020-15711.md): In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. (no CVSS)
- [CVE-2020-1349](https://cve.now/CVE-2020-1349.md): A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsof (no CVSS, Microsoft 365 Apps for Enterprise for 32-bit Systems · M… +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.