CVE-2020-0674: high-severity vulnerability in Microsoft Internet Explorer 10
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Internet Explorer has a memory handling flaw that allows attackers to run harmful code on your computer when you visit a malicious website. The vulnerability exists in how the browser processes scripts, and exploiting it can give attackers full control of your system.
A use-after-free vulnerability (CWE-416) in Internet Explorer's scripting engine allows remote code execution when a specially crafted web page is visited. The attack requires user interaction (visiting a malicious site) and can result in arbitrary code execution with the privileges of the logged-in user.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.