CVE-2020-0770

CVE-2020-0770 is an elevation of privilege vulnerability in the Windows ActiveX Installer Service caused by improper handling of memory. The CNVD entry confirms the syndrome but provides no versioned product scope or patch details. Public documents indicate that exploitation requires local execut...

CVE-2020-0921

Technical details about CVE-2020-0921 are not provided in the connected documents; the materials reference the vulnerability in general terms related to Microsoft Graphics components but do not specify affected products/versions, root cause, or remediation. Monitor for updates.

CVE-2020-0922

Technical details about CVE-2020-0922 are not provided in the connected documents. The Initial Description only notes a remote code execution in Microsoft COM for Windows with a fix in a security update; no product/version/root-cause/exploit details are included here. Monitor for official disclos...

CVE-2020-0949

CVE-2020-0949 is a Windows Media Foundation memory corruption vulnerability caused by improper handling of memory objects. The affected component is Windows Media Foundation; the CVSSv3 base score is 8.8 (HIGH) with HIGH impact on confidentiality, integrity, and availability, and exploitability n...

CVE-2020-0952

CVE-2020-0952 is a Windows GDI Information Disclosure Vulnerability. Connected sources confirm it involves the Windows GDI component disclosing memory contents, enabling information disclosure. Related entries from CNVD-2020-30654 and OpenVAS KEV listings acknowledge this CVE among Windows GDI di...

CVE-2020-0963

The CVE-2020-0963 entry describes an information disclosure vulnerability in the Windows Graphics Device Interface (GDI) where memory contents may be exposed. The vulnerability is tied to the GDI component’s handling of objects in memory, enabling disclosure of memory contents by an attacker. The...

CVE-2020-1033

CVE-2020-1033 (Windows Kernel Information Disclosure) The vulnerability is an information disclosure in the Windows kernel where objects in memory are improperly handled. An authenticated attacker could exploit this by running a specially crafted application to obtain information that could help ...

CVE-2020-1118

CVE-2020-1118 is a denial-of-service vulnerability in the Windows TLS implementation caused by improper handling of certain key exchange messages. An unauthenticated attacker could trigger a system halt or reboot by sending a specially crafted TLS message during handshake, potentially impacting T...

CVE-2020-1241

CVE-2020-1241 is a Windows Kernel security feature bypass vulnerability. It arises when the Kernel fails to properly sanitize certain parameters, allowing a locally authenticated attacker to run a crafted application to bypass security checks. The vulnerability is addressed by updates that correc...

CVE-2020-1245

Technical details about CVE-2020-1245 are not provided in the supplied connected documents; public information in the initial description is high-level. Monitor for official security advisories for affected products, impact, and fixes.

CVE-2020-1280

CVE-2020-1280 is an elevation of privilege vulnerability in Windows Bluetooth Service where memory objects are mishandled. The CVE is documented in NVD as a local, user-initiated issue with potential high impact if exploited, though exploitation details or root-cause specifics are not provided in...

CVE-2020-1305

CVE-2020-1305 is a Windows State Repository Service elevation-of-privilege vulnerability caused by improper handling of in-memory objects. Affected component: Windows State Repository Service on Windows client/server platforms. Impact: attacker could elevate privileges locally. Remediation: patch...

CVE-2020-1365

Technical details about CVE-2020-1365 are not publicly provided in the connected documents. The Windows Event Logging Service elevation-of-privilege vulnerability lacks product/version/impact/fix specifics here. Monitor sources for updates and confirmed technical details.

CVE-2020-1437

CVE-2020-1437 is described in CNVD as an elevation-of-privilege vulnerability in the Windows Network Location Awareness Service. The flaw stems from how the service handles objects in memory, enabling an attacker to execute code with elevated privileges by running a specially crafted application....

CVE-2020-17013

CVE-2020-17013 is a Win32k information disclosure vulnerability in Windows. Available connected documents indicate the issue affects the Win32k subsystem and is associated with information disclosure (confidentiality impact), with CVSS metrics suggesting local access requirements and low to moder...

CVE-2020-17075

CVE-2020-17075 corresponds to a Windows USO Core Worker elevation-of-privilege vulnerability. According to the linked NVD entry, the vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with local attack vector, low attack complexity, and privileges required: LOW; no user interaction needed. Th...

CVE-2021-24090

CVE-2021-24090 is a Windows Elevation of Privilege affecting Windows Error Reporting (WER). The connected records identify the affected component as Windows Error Reporting and classify the vulnerability as privilege escalation with impact on confidentiality, integrity, and availability (per CVSS...

CVE-2021-28311

CVE-2021-28311 is a Windows Application Compatibility Cache Denial of Service vulnerability. The connected documents confirm a Windows OS-level issue affecting the Application Compatibility Cache, with mitigation via March/April 2021 Windows security updates (e.g., KB5001330/KB5001337 and related...

CVE-2021-28351

CVE-2021-28351 is a Windows Speech Runtime Elevation of Privilege vulnerability affecting the Windows Speech Runtime component. The entry provides high-severity context (CVSS v3.1 base score 7.8) with Local attack vector, Low privileges required, and no user interaction, claiming impact to confid...

CVE-2015-2515

CVE-2015-2515 is a remote code execution vulnerability in Windows Shell caused by a use-after-free when handling crafted toolbar objects. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Windows 7 SP1, Windows 8/8.1, Windows Server 2012/2012 R2, Windows RT/RT 8.1, and ...

CVE-2016-3263

CVE-2016-3263 concerns a GDI+/Graphics Device Interface information-disclosure issue across multiple Windows platforms (Vista SP2 through Windows 10 1607, Windows Server equivalents) that allows remote attackers to bypass ASLR via unspecified vectors. Affected components are GDI/GDI+ in Windows a...

CVE-2017-0259

CVE-2017-0259 is a Windows kernel local information-disclosure vulnerability affecting Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 (Gold, 1511, 1607, 1703) and Windows Server 2016. A specially crafted document can cause leakage of sensitive information via the kernel. Public e...

CVE-2017-0287

CVE-2017-0287 relates to a Windows Uniscribe information disclosure vulnerability. The connected Kaspersky advisory explicitly notes an information disclosure in Windows Uniscribe that can be exploited remotely by a crafted document to obtain sensitive information. The provided documents do not s...

CVE-2017-11831

CVE-2017-11831 is a Windows kernel information disclosure vulnerability affecting Windows 7 SP1, Windows 8.1/RT 8.1, Windows Server 2008 SP2/R2 SP1, 2012/R2, Windows 10 (various builds up to 1709) and Windows Server 2016. Root cause: kernel initializes memory in a way that can expose information;...

CVE-2017-11849

The CVE-2017-11849 entry concerns the Windows kernel information disclosure vulnerability. Affected software includes Windows kernel on Windows 7 SP1; Windows Server 2008 SP2/R2 SP1; Windows 8.1/RT 8.1; Windows Server 2012/R2; Windows 10 versions (Gold, 1511, 1607, 1703, 1709); and Windows Server...

CVE-2017-8544

CVE-2017-8544 describes a Windows Search Information Disclosure vulnerability in the Windows Search service caused by how objects are handled in memory. Affected systems span multiple Windows versions: Windows 7 SP1, Windows Server 2008 SP2/R2 SP1, Windows 8.1/RT 8.1, Windows Server 2012/R2, Wind...

CVE-2017-8564

CVE-2017-8564 is the Windows kernel information disclosure vulnerability where the kernel fails to properly initialize a memory address, potentially allowing an attacker to retrieve kernel base information and bypass KASLR. Affected products include Windows client and server families (Windows 7/8...

CVE-2017-8687

CVE-2017-8687 is a Windows kernel information-disclosure vulnerability in the Win32k subsystem where improper handling of memory objects allows leakage of kernel memory to user mode. Affected products include Windows 7 SP1, Windows 8.1, Windows Server 2008 SP2/R2 SP1, Windows Server 2012, Windows...

CVE-2018-8637

CVE-2018-8637 is a Windows kernel vulnerability (Win32k Information Disclosure) that can disclose memory addresses from kernel space, potentially bypassing KASLR. Affected: Windows kernel components (Win32k) on Windows 10/Windows Server 2019. Root cause: how the kernel handles memory addresses en...

CVE-2019-1171

CVE-2019-1171 is an information-disclosure vulnerability in SymCrypt during OAEP decryption. The underlying issue is in OAEP decoding operations, allowing an attacker who can log on to an affected system to obtain information that could aid further compromise. The CVE does not enable code executi...

CVE-2019-1336

CVE-2019-1336 describes an elevation-of-privilege vulnerability in the Microsoft Windows Update Client caused by improper handling of privileges. The issue is local and affects the Windows Update Client; the CVE is distinct from CVE-2019-1323. The provided documents do not specify affected versio...

CVE-2019-1399

Technical details beyond the high-level description (affected product, root cause, vulnerable component, specific versions, fixes) are not publicly provided in the connected documents. Monitor for updates.

CVE-2019-1417

CVE-2019-1417 involves an Elevation of Privilege in Windows Data Sharing Service due to improper handling of file operations. Affected product: Windows operating systems with the Data Sharing Service. The root cause is improper file operation handling that enables local privilege escalation. Impa...

CVE-2020-0616

CVE-2020-0616 is a Windows denial-of-service flaw caused by improper handling of hard links. An attacker must log on to an affected system and run a crafted application to disrupt the target (potentially overwrite system files). Microsoft’s update fixes ACLs on system files to address this vulner...

CVE-2020-0714

CVE-2020-0714 corresponds to a DirectX Information Disclosure vulnerability in Windows. The root cause is DirectX failing to properly handle memory objects, which can lead to disclosure of information. An attacker who has authenticated access could exploit this by running a specially crafted appl...

CVE-2020-0754

Technical details for CVE-2020-0754 are not provided in the connected documents; only high-level information is available.

CVE-2020-0800

CVE-2020-0800 corresponds to a Windows Work Folder Service privilege escalation vulnerability. CNVD-2020-23447 describes improper handling of file operations in the Work Folder Service that can be exploited by a specially crafted application to run code with elevated privileges. The vulnerability...

CVE-2020-0866

The CVE-2020-0866 entry maps to a Windows Work Folder Service elevation of privilege vulnerability. Connected CNVD-2020-23447 describes a privilege escalation via the service’s improper handling of file operations, enabling a specially crafted application to execute processes with elevated privil...

CVE-2020-0897

Technical details about CVE-2020-0897 (affected product, root cause, impacted versions, and fixes) are not publicly provided in the connected documents; monitor for updates.

CVE-2020-0928

CVE-2020-0928 is a Windows kernel information-disclosure vulnerability. The root cause is the Windows kernel’s improper handling of memory objects, which could allow an attacker who logs on and runs a crafted application to obtain information that could help further compromise the system. The vul...

CVE-2020-1068

Technical details for CVE-2020-1068 are not publicly available in the provided documents. Monitor for updates; no explicit info on affected products, root cause, impact, or remediation is included here.

CVE-2020-1081

CVE-2020-1081 is an elevation-of-privilege issue in the Windows Printer Service caused by improper validation of file paths when loading printer drivers. Affected product: Windows Printer Service. Root cause details and specific vulnerable versions are not enumerated in the provided documents bey...

CVE-2020-1119

CNVD-2021-63316 describes a Windows information disclosure vulnerability (CVE-2020-1119) arising from StartTileData.dll improperly handling objects in memory, allowing an attacker who can log on to an affected system and run a crafted application to obtain information that could help compromise t...

CVE-2020-1123

CVE-2020-1123 is a denial-of-service vulnerability in Microsoft Windows Connected User Experiences and Telemetry Service, arising from improper handling of operations (e.g., file-related handling) and related to the CVE-2020-1084 distinction. Connected documents corroborate DoS impact from failur...

CVE-2020-1265

Technical details about CVE-2020-1265 are not present in the connected documents; the provided sources do not specify affected products, root cause, or remediation. Monitor for updates.

CVE-2020-1304

Technical details for CVE-2020-1304 are not provided in the connected documents. No affected products, root cause, impact, or fixes are present here. Monitor for updates from official advisories.

CVE-2020-1344

CVE-2020-1344 is a Windows WalletService elevation-of-privilege vulnerability rooted in how WalletService handles objects in memory, potentially allowing a crafted app to execute code with elevated privileges. Related entries (CVE-2020-1362/1369) describe the same WalletService memory-handling th...

CVE-2020-1368

CVE-2020-1368 is a Windows elevation-of-privilege vulnerability in the Windows Credential Enrollment Manager Service. The CNVD entry states that the issue stems from how the Credential Enrollment Manager Service handles objects in memory, which an attacker can exploit by running a specially craft...

CVE-2020-1397

CVE-2020-1397 is an information-disclosure flaw in Windows Imaging Component (WIC) related to how WindowsCodecs handles image decoding, particularly TIFF/CCITT paths. FireEye’s analysis identifies the root cause as uninitialized memory flowing through the image decoding pipeline (TIFFReadBufferSe...

CVE-2020-1401

CVE-2020-1401 is a Remote Code Execution vulnerability in Microsoft Windows/Windows Server arising from improper handling of objects in memory by the Jet Database Engine. The connected CNVD entries describe the root cause as a failure of the Jet Database Engine to properly handle in-memory object...