CVE-2020-27352

CRITICAL Year: 2020
CVSS v3 Score
9.3
Critical
Weakness Type
CWE-269
View all →

Vulnerability Description

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.

Related Vulnerabilities

CVE-2018-4008

CRITICAL
CVSS:9.3(Critical)

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplied script argument and executes it under r...

CWE-2692018

CVE-2022-3405

CRITICAL
CVSS:9.3(Critical)

Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 2...

CWE-2692022

CVE-2024-36439

CRITICAL
CVSS:9.4(Critical)

Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password.

CWE-2692024

CVE-2017-5142

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the par...

CWE-2692017

CVE-2018-1000141

CRITICAL
CVSS:9.1(Critical)

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to proje...

CWE-2692018

CVE-2018-13799

CRITICAL
CVSS:9.1(Critical)

A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an unauthenticated remo...

CWE-2692018