CVE-2020-1559

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

<p>An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p> <p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p> <p>The security update addresses the vulnerability by ensuring the Windows Storage Services properly handle file operations.</p>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-155907.5A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPNCVE-2020-155919.8fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).CVE-2020-155927.5SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a CVE-2020-155937.8SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perfCVE-2020-155944.3An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attaCVE-2020-155954.3An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements iCVE-2020-155966.7The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path DiCVE-2020-155975.4SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.CVE-2020-155987.5Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaledCVE-2020-155996.1Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.CVE-2020-15607.8A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who sucCVE-2020-156006.5An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-1559: High severity, CVSS 7.8 | Vulnix