CVE-2020-12431

MEDIUM Year: 2020
CVSS v3 Score
6.6
Medium
CVSS v2 Score
6.3
Medium
Weakness Type
CWE-732
View all →

Vulnerability Description

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0).

Related Vulnerabilities

CVE-2018-11053

MEDIUM
CVSS:6.6(Medium)

Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating s...

CWE-7322018

CVE-2019-14743

MEDIUM
CVSS:6.6(Medium)

In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local users to gain NT AUTHORITY\SYSTEM access...

CWE-7322019

CVE-2025-42997

MEDIUM
CVSS:6.6(Medium)

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behav...

CWE-7322025

CVE-2015-9456

MEDIUM
CVSS:6.5(Medium)

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save...

CWE-7322015

CVE-2017-1000095

MEDIUM
CVSS:6.5(Medium)

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the acc...

CWE-7322017

CVE-2017-1000221

MEDIUM
CVSS:6.5(Medium)

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need ...

CWE-7322017