Look up vulnerabilities by software, product or CVE number.
| CVE | Published | CVSS | ShadowTrackr CVSS | Summary |
|---|---|---|---|---|
CVE: CVE-2020-1690 | Published 2021-06-07 | CVSS: 6.5 | ShadowTrackr CVSS: 4.7 | Summary: An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected. |
CVE: CVE-2020-16908 | Published 2020-10-16 | CVSS: 7.8 | ShadowTrackr CVSS: 6.4 | Summary: <p>An elevation of privilege vulnerability exists in Windows Setup in the way it handles directories.</p>
<p>A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by ensuring Windows Setup properly handles directories.</p> |
CVE: CVE-2020-16909 | Published 2020-10-16 | CVSS: 7.8 | ShadowTrackr CVSS: 6.4 | Summary: <p>An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.</p>
<p>An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting the way that WER handles and executes files.</p> |
CVE: CVE-2020-16905 | Published 2020-10-16 | CVSS: 6.8 | ShadowTrackr CVSS: 4.3 | Summary: <p>An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.</p>
<p>An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting the way that WER handles and executes files.</p> |
CVE: CVE-2020-16907 | Published 2020-10-16 | CVSS: 7.8 | ShadowTrackr CVSS: 6.4 | Summary: <p>An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p>
<p>The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.</p> |
CVE: CVE-2020-16902 | Published 2020-10-16 | CVSS: 7.8 | ShadowTrackr CVSS: 6.4 | Summary: <p>An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.</p>
<p>A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.</p> |
CVE: CVE-2020-16904 | Published 2020-10-16 | CVSS: 5.3 | ShadowTrackr CVSS: 2.9 | Summary: <p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p>
<p>An unauthenticated attacker who successfully exploited this vulnerability could invoke an HTTP Function without proper authorization.</p>
<p>This security update addresses the vulnerability by correctly validating access keys used to access HTTP Functions.</p> |
CVE: CVE-2020-16900 | Published 2020-10-16 | CVSS: 7.0 | ShadowTrackr CVSS: 6.4 | Summary: <p>An elevation of privilege vulnerability exists when the Windows Event System improperly handles objects in memory.</p>
<p>To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.</p>
<p>The security update addresses the vulnerability by correcting how the Windows Event System handles objects in memory.</p> |
CVE: CVE-2020-16901 | Published 2020-10-16 | CVSS: 5.0 | ShadowTrackr CVSS: 1.5 | Summary: <p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p>
<p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p>
<p>The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.</p> |