CVE-2020-14990

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

IOBit Advanced SystemCare Free 13.5.0.263 allows local users to gain privileges for file deletion by manipulating the Clean & Optimize feature with an NTFS junction and an Object Manager symbolic link.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://daniels-it-blog.blogspot.com/2020/06/arbitrary-file-deletion-in-iobit.htmlExploit, Third Party Advisory
https://github.com/Daniel-itsec/AdvancedSystemCareExploit, Third Party Advisory
https://daniels-it-blog.blogspot.com/2020/06/arbitrary-file-deletion-in-iobit.htmlExploit, Third Party Advisory
https://github.com/Daniel-itsec/AdvancedSystemCareExploit, Third Party Advisory

Timeline

Published: Jun 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-149939.8A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute arbit CVE-2020-149997.5A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection CVE-2020-15005.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-150005.9A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and CVE-2020-150015.3An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to s CVE-2020-150025.0OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.CVE-2020-150034.3OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (CVE-2020-150044.8OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.CVE-2020-150053.1In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_a CVE-2020-150065.4Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php.CVE-2020-150079.8A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe us CVE-2020-150087.5A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation t