VulnerabilitycriticalExploited in the wild

Microsoft May 2020 Patch Tuesday fixes 111 flaws, 13 Critical

Security Affairsby @securityaffairsMay 13, 2020 · 10:56 UTC (May 13, 2020)6 min read3 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2020-1071 CVE-2020-1135 CVE-2020-1067 CVE-2020-1161 CVE-2020-1108 CVE-2020-1066 CVE-2020-1055 CVE-2020-1154 CVE-2020-1092 CVE-2020-1064 CVE-2020-1062 CVE-2020-1093 CVE-2020-1063 CVE-2020-1059 CVE-2020-1056 CVE-2020-1096 CVE-2020-1145 CVE-2020-1179 CVE-2020-1153 CVE-2020-1140 CVE-2020-0963 CVE-2020-1054 CVE-2020-1142 CVE-2020-1117 CVE-2020-1141 CVE-2020-1176 CVE-2020-1051 CVE-2020-1175 CVE-2020-1174 CVE-2020-0901 CVE-2020-1069 CVE-2020-1100 CVE-2020-1105 CVE-2020-1102 CVE-2020-1024 CVE-2020-1023 CVE-2020-1104 CVE-2020-1101 CVE-2020-1099 CVE-2020-1103 CVE-2020-1107 CVE-2020-1106 CVE-2020-1060 CVE-2020-1065 CVE-2020-1037 CVE-2020-1035 CVE-2020-1058 CVE-2020-1111 CVE-2020-1112 CVE-2020-1082 CVE-2020-1086 CVE-2020-1048 CVE-2020-1090 CVE-2020-1088 CVE-2020-1166 CVE-2020-1021 CVE-2020-1164 CVE-2020-1165 CVE-2020-1184 CVE-2020-1188 CVE-2020-1191 CVE-2020-1185 CVE-2020-1187 CVE-2020-1125 CVE-2020-1131 CVE-2020-1121 CVE-2020-1123 CVE-2020-1132

Tags: cve-2020-1071 cve-2020-1135 cve-2020-1067 cve-2020-1161 cve-2020-1108 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-0901	A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory	9.8	4%		May 21, 2020
CVE-2020-1117 +37 related CVEs CVE-2020-1112 CVE-2020-1048 CVE-2020-1153 CVE-2020-1051 CVE-2020-1174 CVE-2020-1175 CVE-2020-1176 CVE-2020-1067 CVE-2020-1191 CVE-2020-1082 CVE-2020-1135 CVE-2020-1111+25 more	A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory	8.8 group max	4%		May 21, 2020
CVE-2020-1102 +11 related CVEs CVE-2020-1069 CVE-2020-1024 CVE-2020-1023 CVE-2020-1103 CVE-2020-1106 CVE-2020-1099 CVE-2020-1100 CVE-2020-1101 CVE-2020-1104 CVE-2020-1105 CVE-2020-1107	A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package	8.8 group max	5%		May 21, 2020
CVE-2020-1062 +6 related CVEs CVE-2020-1035 CVE-2020-1064 CVE-2020-1093 CVE-2020-1058 CVE-2020-1060 CVE-2020-1092	A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory	7.5	6%		May 21, 2020
CVE-2020-1056 +3 related CVEs CVE-2020-1059 CVE-2020-1037 CVE-2020-1096	An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access…	5.4 group max	2%		May 21, 2020
CVE-2020-1054	Privilege Escalation in Microsoft Windows Win32k Kernel Driver (CVE-2020-1054)	7.0	54%	KEVPoC	May 21, 2020 KEV Nov 3, 2021
CVE-2020-1063	A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected…	5.4	1%		May 21, 2020
CVE-2020-1065	A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory	4.2	2%		May 21, 2020
CVE-2020-1066	An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level	7.8	2%		May 21, 2020
CVE-2020-1108	A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests	7.5	6%		May 21, 2020
CVE-2020-1161	A denial of service vulnerability exists when ASP.NET Core improperly handles web requests	7.5	5%		May 21, 2020

From the original article

6 min read at securityaffairs.com

Microsoft issued May 2020 Patch Tuesday security updates that addressed 111 vulnerabilities impacting 12 products, including Microsoft Windows, Microsoft Edge, ChakraCore, Internet Explorer, Microsoft Office, and Microsoft Office Services and Web Apps, Visual Studio, Microsoft Dynamics, . NET Framework, . NET Core, and Power BI.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.