CVE-2020-0654

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint requirements of the App.The security update addresses the vulnerability by correcting the way Microsoft OneDrive App for Android handles sharing links., aka 'Microsoft OneDrive for Android Security Feature Bypass Vulnerability'.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-06558.0A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated atCVE-2020-06565.4A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web reqCVE-2020-06577.8An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aCVE-2020-06585.5An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects CVE-2020-06597.8An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data SCVE-2020-06607.5A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sendsCVE-2020-06616.8A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on CVE-2020-06628.8A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution VulnerabiCVE-2020-06634.2An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attCVE-2020-06646.5<p>An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticatCVE-2020-06658.1An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trustCVE-2020-06667.8An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind
CVE-2020-0654: Critical severity, CVSS 9.1 | Vulnix