CVE-2020-35686

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may allow escalation of privilege via a fake DLL. (As a resolution, Windows Update is being submitted for all affected products to update to 2.0.9.18 or later.)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-356874.3PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the log CVE-2020-35698.6Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthent CVE-2020-356938.8On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) devic CVE-2020-356986.1Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (r CVE-2020-357008.8A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allo CVE-2020-357018.8An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers CVE-2020-357027.8DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. NOTE: later reports indi CVE-2020-357045.4Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.CVE-2020-357055.4Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.CVE-2020-357065.4Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.CVE-2020-357075.4Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.CVE-2020-357087.2phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.