CVE-2020-1144

HighCVSS 7.8/10Last modified Aug 19, 2026

Description

An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The update addresses the vulnerability by correcting the way the Windows State Repository Service handles objects in memory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-114407.5httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.CVE-2020-114416.1phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be refle CVE-2020-114438.1The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing CVE-2020-114448.8Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.CVE-2020-114455.3TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involv CVE-2020-114467.8ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET di CVE-2020-114474.3An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req CVE-2020-114486.1An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.CVE-2020-114497.5An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsett CVE-2020-11455.5An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allow CVE-2020-114507.5Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStr CVE-2020-114517.2The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files w