Microsoft Windows 10 Version 1903 For X64 Based Systems vulnerabilities, page 5
1,069 vulnerabilities
Known vulnerabilities in Microsoft Windows 10 Version 1903 For X64 Based Systems, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2020-1585microsoft · windows_10 +9 moreMicrosoft Windows Codecs Library Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Exploitation of the vulnerability requires that a program process a specially crafted image file.
The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.EPSS4.93%HighCVE-2020-1490microsoft · windows_10 +18 moreWindows Storage Service Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges on the victim system.
To exploit the vulnerability, an attacker would first have to gain execution on the victim system, then run a specially crafted application.
The security update addresses the vulnerability by correcting how the Storage Services handles file operations.EPSS0.74%MediumCVE-2020-1330microsoft · windows +16 moremicrosoft windowsAn information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device Management Diagnostics Information Disclosure Vulnerability'.EPSS1.28%HighCVE-2020-1316microsoft · windows +16 moremicrosoft windowsAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307.EPSS0.96%MediumCVE-2020-1598microsoft · windows_10 +32 moreWindows UPnP Service Elevation of Privilege Vulnerability<p>An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.</p>
<p>The update addresses the vulnerability by correcting how the Windows UPnP service handles objects in memory.</p>EPSS0.92%HighCVE-2020-1111microsoft · windows_10 +9 moreWindows Clipboard Service Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control over an affected system.
The update addresses the vulnerability by correcting how Windows handles calls to Clipboard Service.EPSS0.95%CriticalCVE-2020-1339microsoft · windows_10 +32 moreWindows Media Remote Code Execution VulnerabilityA remote code execution vulnerability exists when Windows Media Audio Codec improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.
There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage.
The security update addresses the vulnerability by correcting how Windows Media Audio Codec handles objects.EPSS3.32%HighCVE-2020-1480microsoft · windows_10 +15 moreWindows GDI Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The update addresses the vulnerability by correcting how GDI handles objects in memory and by preventing instances of unintended user-mode privilege elevation.EPSS0.90%HighCVE-2020-1068microsoft · windows_10 +17 moreMicrosoft Windows Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.
To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The update addresses the vulnerability by correcting how the Windows Media Service handles file creation.EPSS0.95%HighCVE-2020-1310microsoft · windows +15 moremicrosoft windowsAn elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1251, CVE-2020-1253.EPSS0.97%HighCVE-2020-1417microsoft · windows_10 +15 moreWindows Kernel Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.EPSS1.44%HighCVE-2020-1272microsoft · windows +21 moremicrosoft windowsAn elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1277, CVE-2020-1302, CVE-2020-1312.EPSS0.81%MediumCVE-2020-1133microsoft · microsoft visual studio 2015 update 3 +26 moreDiagnostics Hub Standard Collector Elevation of Privilege Vulnerability<p>An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p>
<p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p>
<p>The update addresses the vulnerability by correcting the way the Diagnostics Hub Standard Collector handles file operations.</p>EPSS0.98%HighCVE-2020-1571microsoft · windows_10 +7 moreWindows Setup Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists in Windows Setup in the way it handles permissions.
A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
The security update addresses the vulnerability by ensuring Windows Setup properly handles permissions.EPSS1.08%MediumCVE-2020-1263microsoft · windows +20 moremicrosoft windowsAn information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error Reporting Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1261.EPSS1.30%HighCVE-2020-1211microsoft · windows +16 moremicrosoft windowsAn elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service Elevation of Privilege Vulnerability'.EPSS3.03%HighCVE-2020-1264microsoft · windows +16 moremicrosoft windowsAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.EPSS0.85%HighCVE-2020-1553microsoft · windows_10 +18 moreWindows Runtime Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.
An attacker could exploit this vulnerability by running a specially crafted application on the victim system.
The update addresses the vulnerability by correcting the way the Windows Runtime handles objects in memory.EPSS0.74%HighCVE-2020-1244microsoft · windows +16 moremicrosoft windowsA denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Denial of Service Vulnerability'. This CVE ID is unique from CVE-2020-1120.EPSS3.02%HighCVE-2020-1203microsoft · microsoft visual studio +24 moremicrosoft microsoft visual studioAn elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to properly handle objects in memory, aka 'Diagnostic Hub Standard Collector Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1202.EPSS0.95%