CVE-2020-1199

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Windows Feedback Hub improperly handles objects in memory, aka 'Windows Feedback Hub Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809 for HoloLens	unspecified
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified
Microsoft	Windows	10 Version 1709 for x64-based Systems; 10 Version 1803 for x64-based Systems; 10 Version 1809 for x64-based Systems
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 2004 for HoloLens	unspecified
Microsoft	Windows 10 Version 1903 for HoloLens	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1199Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1199Patch, Vendor Advisory

Timeline

Published: Jun 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119903.3We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who coul CVE-2020-119917.5When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be us CVE-2020-119937.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, loggin CVE-2020-119947.5Server-Side Template Injection and arbitrary file disclosure on Camel templating components CVE-2020-119959.8A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo us CVE-2020-119967.5A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t CVE-2020-119974.3Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users sha CVE-2020-119989.8A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of CVE-2020-119998.1FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-12008.6<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application CVE-2020-120007.5The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied CVE-2020-120019.8FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont