CVE-2020-13533

CRITICAL Year: 2020
CVSS v3 Score
9.3
Critical
CVSS v2 Score
4.4
Medium
Weakness Type
CWE-276
View all →

Vulnerability Description

A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs in and uses the application.

Related Vulnerabilities

CVE-2020-13532

CRITICAL
CVSS:9.3(Critical)

A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges t...

CWE-2762020

CVE-2020-13534

CRITICAL
CVSS:9.3(Critical)

A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 with weak privileges wh...

CWE-2762020

CVE-2020-13535

CRITICAL
CVSS:9.3(Critical)

A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYS...

CWE-2762020

CVE-2020-13536

CRITICAL
CVSS:9.3(Critical)

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code t...

CWE-2762020

CVE-2020-13537

CRITICAL
CVSS:9.3(Critical)

An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code t...

CWE-2762020

CVE-2020-13539

CRITICAL
CVSS:9.3(Critical)

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911 Mobile Runtime” service. Depending on the...

CWE-2762020