Vulnerabilitycritical

Microsoft Patch Tuesday — May 2020: Vulnerability disclosures and Snort coverage

Cisco TalosMay 12, 2020 · 19:05 UTC (May 12, 2020)3 min read3 · 1 read

Read at blog.talosintelligence.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2020-0901 CVE-2020-1023 CVE-2020-1024 CVE-2020-1069 CVE-2020-1102 CVE-2020-1062 CVE-2020-1028 CVE-2020-1056 CVE-2020-1064 CVE-2020-1065 CVE-2020-1093 CVE-2020-1117 CVE-2020-1126 CVE-2020-1136 CVE-2020-1153 CVE-2020-1192 CVE-2020-1103 CVE-2020-0909 CVE-2020-0963 CVE-2020-1010 CVE-2020-1021 CVE-2020-1035 CVE-2020-1048 CVE-2020-1051 CVE-2020-1054 CVE-2020-1055 CVE-2020-1058 CVE-2020-1059 CVE-2020-1060 CVE-2020-1061 CVE-2020-1063 CVE-2020-1066 CVE-2020-1067 CVE-2020-1068 CVE-2020-1070 CVE-2020-1071 CVE-2020-1072 CVE-2020-1075 CVE-2020-1076 CVE-2020-1077 CVE-2020-1078 CVE-2020-1079 CVE-2020-1081 CVE-2020-1082 CVE-2020-1084 CVE-2020-1086 CVE-2020-1087 CVE-2020-1088 CVE-2020-1090 CVE-2020-1092 CVE-2020-1096 CVE-2020-1099 CVE-2020-1100 CVE-2020-1101 CVE-2020-1104 CVE-2020-1105 CVE-2020-1106 CVE-2020-1107 CVE-2020-1108 CVE-2020-1109 CVE-2020-1110 CVE-2020-1111 CVE-2020-1112 CVE-2020-1113 CVE-2020-1114 CVE-2020-1116 CVE-2020-1118 CVE-2020-1121 CVE-2020-1123 CVE-2020-1124 CVE-2020-1125 CVE-2020-1131 CVE-2020-1132 CVE-2020-1134 CVE-2020-1135 CVE-2020-1137 CVE-2020-1138 CVE-2020-1139 CVE-2020-1140 CVE-2020-1141 CVE-2020-1142 CVE-2020-1143 CVE-2020-1144 CVE-2020-1145 CVE-2020-1149 CVE-2020-1150 CVE-2020-1151 CVE-2020-1154 CVE-2020-1155 CVE-2020-1156 CVE-2020-1157 CVE-2020-1158 CVE-2020-1161 CVE-2020-1164 CVE-2020-1165 CVE-2020-1166 CVE-2020-1171 CVE-2020-1173 CVE-2020-1174 CVE-2020-1175 CVE-2020-1176 CVE-2020-1179 CVE-2020-1184 CVE-2020-1185 CVE-2020-1186 CVE-2020-1187 CVE-2020-1188 CVE-2020-1189 CVE-2020-1190 CVE-2020-1191 CVE-2020-1037

Tags: cve-2020-0901 cve-2020-1023 cve-2020-1024 cve-2020-1069 cve-2020-1102 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-0901	A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory	9.8	4%		May 21, 2020
CVE-2020-1126 +77 related CVEs CVE-2020-1117 CVE-2020-1118 CVE-2020-1112 CVE-2020-1048 CVE-2020-1153 CVE-2020-1028 CVE-2020-1136 CVE-2020-1051 CVE-2020-1174 CVE-2020-1175 CVE-2020-1176 CVE-2020-1150+65 more	A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory	8.8 group max	4%		May 21, 2020
CVE-2020-1102 +11 related CVEs CVE-2020-1069 CVE-2020-1024 CVE-2020-1023 CVE-2020-1103 CVE-2020-1106 CVE-2020-1099 CVE-2020-1100 CVE-2020-1101 CVE-2020-1104 CVE-2020-1105 CVE-2020-1107	A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package	8.8 group max	5%		May 21, 2020
CVE-2020-1062 +6 related CVEs CVE-2020-1035 CVE-2020-1064 CVE-2020-1093 CVE-2020-1058 CVE-2020-1060 CVE-2020-1092	A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory	7.5	6%		May 21, 2020
CVE-2020-1056 +3 related CVEs CVE-2020-1059 CVE-2020-1037 CVE-2020-1096	An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access…	5.4 group max	2%		May 21, 2020
CVE-2020-1054	Privilege Escalation in Microsoft Windows Win32k Kernel Driver (CVE-2020-1054)	7.0	54%	KEVPoC	May 21, 2020 KEV Nov 3, 2021
CVE-2020-1063	A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected…	5.4	1%		May 21, 2020
CVE-2020-1065	A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory	4.2	2%		May 21, 2020
CVE-2020-1066	An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level	7.8	2%		May 21, 2020
CVE-2020-1108	A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests	7.5	6%		May 21, 2020
CVE-2020-1161	A denial of service vulnerability exists when ASP.NET Core improperly handles web requests	7.5	5%		May 21, 2020
CVE-2020-1171 +1 related CVE CVE-2020-1192	A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project	8.8 group max	5%		May 21, 2020
CVE-2020-1173	A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments	6.8	2%		May 21, 2020

From the original article

3 min read at blog.talosintelligence.com

Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 111 vulnerabilities. Fifteen of the flaws Microsoft disclosed are considered critical.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.