CVE-2020-1356

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations, aka 'Windows iSCSI Target Service Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows Server, version 2004 (Server Core installation)unspecified
MicrosoftWindows Server2019; 2019 (Core installation); 2016; 2016 (Core installation); 2012; 2012 (Core installation); 2012 R2; 2012 R2 (Core installation)
MicrosoftWindows Server, version 1909 (Server Core installation)unspecified
MicrosoftWindows Server, version 1903 (Server Core installation)unspecified

References

Timeline

Published
Jul 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-135608.8A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially craftCVE-2020-135618.8An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to coCVE-2020-135626.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbCVE-2020-135636.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbCVE-2020-135646.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbCVE-2020-135656.1An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development vCVE-2020-135668.8SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an CVE-2020-135679.8Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker canCVE-2020-135688.8SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HCVE-2020-135698.8A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f6CVE-2020-13577.8An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations, aka 'Windows SystemCVE-2020-135708.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF