CVE-2020-1367

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1389, CVE-2020-1419, CVE-2020-1426.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 2004 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 2004 for ARM64-based Systems	unspecified
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified
Microsoft	Windows Server, version 2004 (Server Core installation)	unspecified
Microsoft	Windows	10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems
Microsoft	Windows Server	2019; 2019 (Core installation)
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1367Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1367Patch, Vendor Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-136707.5Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent pri CVE-2020-136718.8Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten CVE-2020-136726.1Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circu CVE-2020-136736.1The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an CVE-2020-136746.5The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and CVE-2020-136759.8Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, wh CVE-2020-136766.5The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. CVE-2020-136777.5Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintend CVE-2020-13687.8An elevation of privilege vulnerability exists in the way that the Credential Enrollment Manager service handles objects in memory, aka 'Win CVE-2020-136886.1Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in or CVE-2020-13697.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi CVE-2020-136927.7PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.