The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in Visual     Studio when the software fails to check the source     markup of XML file input. An attacker who successfully     exploited the vulnerability could run arbitrary code in     the context of the process responsible for     deserialization of the XML content. (CVE-2020-1147)

  - An elevation of privilege vulnerability exists when the     Windows Diagnostics Hub Standard Collector Service fails     to properly sanitize input, leading to an unsecure     library-loading behavior. An attacker who successfully     exploited this vulnerability could run arbitrary code with     elevated system privileges. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights. To exploit this     vulnerability, an attacker would have to log on to an     affected system and run a specially crafted application.
    (CVE-2020-1393)

  - An elevation of privilege vulnerability exists in Visual     Studio and Visual Studio Code when they load software     dependencies. A local attacker who successfully exploited     the vulnerability could inject arbitrary code to run in the     context of the current user. If the current user is logged     on with administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or create     new accounts with full user rights. To exploit this     vulnerability, a local attacker would need to plant malicious     content on an affected computer and wait for another user to     launch Visual Studio or Visual Studio Code. (CVE-2020-1416)

Detections

Analytics

Security Updates for Microsoft Visual Studio Products (July 2020)

high Nessus Plugin ID 138473

Version 1.16

Version 1.15

Version 1.14

Version 1.16 Jul 25, 2023, 7:12 PM Detection Plugin Feed: 202307251912
Version 1.15 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.14 Jan 24, 2023, 7:02 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301241902