Vulnerabilities published in 2020

Recent High and Critical vulnerabilities for which exploits are available

Excel download

Over 90% of successful attacks today could have been prevented by applying a patch. In most cases, these patches were available for over a year. Applying patches is the single most effective risk mitigation strategy organizations can implement.

However, most of the published vulnerabilities are not being exploited 'in the wild'. The availability of exploit code is therefore an important factor to decide which patches should be prioritized*.

CVE Vendor Title Included CVSS V2/V3 Base Score Description
CVE 2020-1350 Microsoft Windows DNS Server Remote Code Execution Vulnerability 16/07/2020 10 A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability. To exploit the vulnerability, an unauthenticated attacker could send malicious requests to a Windows DNS server.
CVE-2020-12388 Mozilla Firefox Default Content Process DACL Sandbox Escape 26/06/2020 10 The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR versions lower than 68.8 and Firefox versions lower than 76.
 CVE-2020-3765  Adobe Adobe After Effects Out-of-Bounds Write Vulnerability (APSB20-09)  21/05/2020 10 Adobe After Effects have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. 
 CVE-2020-0609 Microsoft Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability 21/05/2020 10 A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system.
 CVE-2020-0796 Microsoft Microsoft Windows SMBv3 Client/Server Remote Code Execution Vulnerability 21/05/2020 10 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
CVE-2018-4878 Adobe Adobe Flash Player Use After Free Remote Code Execution Vulnerability 21/05/2020 9.8 A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution.
CVE-2019-0604 Microsoft Microsoft Sharepoint Remote Code Execution Vulnerability 21/05/2020 9.8 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package
CVE 2019-16452 Adobe Adobe User After Free Arbitrary Code Execution Vulnerability 28/05/2020 9.8 Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
 CVE-2020-0665 Microsoft Microsoft Active Directory Privilege Escalation Vulnerability 21/05/2020 9 The vulnerability exists in Active Directory Forest trust due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest. The vulnerability allows a remote user to escalate privileges on the system. A remote user can gain elevated privileges on the target system. 
 CVE-2020-0688 Microsoft Microsoft Exchange Memory Corruption Vulnerability 21/05/2020 8.8 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.
CVE-2020-1181 Microsoft Microsoft SharePoint Server Remote Code Execution Vulnerability 25/06/2020 8.8 A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security context of the SharePoint application pool process. To exploit the vulnerability, an authenticated user must create and invoke a specially crafted page on an affected version of Microsoft SharePoint Server.
CVE-2020-3947 VMWare VMWare Workstation vmnetdhcp Denial of Service Vulnerability 21/05/2020 8.8 VMware Workstation contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial of service condition of the vmnetdhcp service running on the host machine.
CVE-2017-0143 Microsoft Microsoft SMB Remote Code Execution Vulnerability 21/05/2020 8.1 "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka ""Windows SMB Remote Code Execution Vulnerability."""
CVE-2020-0642 Microsoft Microsoft Windows Win32k Privilege Escalation 04/08/2020 7.8 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
CVE-2020-1048 Microsoft Windows Print Spooler Elevation of Privilege Vulnerability 26/06/2020 7.8 "An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application."
 CVE-2020-0787 Microsoft Microsoft Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability 21/05/2020 7.8 An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
CVE-2020-1206 Microsoft Microsoft Windows SMBv3 Client/Server Remote Code Execution Vulnerability 26/06/2020 7.5 An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 server. To exploit the vulnerability against a client, an unauthenticated attacker would need to configure a malicious SMBv3 server and convince a user to connect to it.
 CVE-2020-0674 Microsoft Microsoft Scripting Engine Memory Corruption Vulnerability 21/05/2020 7.5 "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. An attacker could then install programs; view, change, or delete data or create new accounts with full user rights."
 CVE-2020-3941 VMWare VMWare Privilege Escalation Vulnerability 21/05/2020 7.2 A vulnerability exists in VMware Tools for windows, which may allow for privilege escalation in the Virtual Machine where Tools is installed. A malicious actor on the guest VM might exploit the race condition and escalate their privileges on a Windows VM. 

*This list has been compiled using different sources, and it focuses on vulnerabilities published in 2020, affecting Windows Operating Systems and some commonly used applications for Windows, with a CVS Score of 7.0 or higher. This is not an exhaustive list and it is provided as is, to help in prioritization efforts. It is not intended to be a replacement for any other source of vulnerability information.

Our Solutions

Guarantee the safety of your clients

Cytomic EPDR

Protección, detección y respuesta de los ciberataques y Zero-Trust App Service

Integra en una única solución un stack completo de tecnologías preventivas en el endpoint, con capacidades EDR y el Servicio Zero-Trust Application.

Cytomic EPDR previene, detecta y responde a cualquier tipo de malware conocido y desconocido, ataques sin archivos y sin malware.

También se basa en el servicio exclusivo de aplicaciones Zero-Trust app, para evitar ejecuciones de malware en el endpoint. Extiende Cytomic EDR con una gama completa de capacidades de Protección Endpoint.

Cytomic Patch

Detención y solución de vulnerabilidades

Proporciona asesoramiento sobre vulnerabilidades y gestión de parches para sistemas operativos y aplicaciones de terceros en puestos de trabajo y servidores de Windows para reducir la superficie de ataque e impedir que las amenazas lleguen al endpoint.

Ofrece visibilidad centralizada en tiempo real del estado de seguridad de las vulnerabilidades del software, parches que faltan, actualizaciones y software no compatible (EOL), y herramientas para parchear en tiempo real todos los dispositivos de una empresa.

No requiere la implementación de nuevos agentes en el edpoint o consola de administración, ya que está integrado en todas las soluciones de Cytomic.

Contact us

Let's fight cyber criminals together

If you need more information Get in touch with your sales rep