CVE-2020-1569
HighSummary
W Microsoft Edge występuje podatność na zdalne wykonanie kodu, spowodowana niewłaściwym dostępem do obiektów w pamięci. Atakujący może wykorzystać tę podatność do wykonania dowolnego kodu w kontekście aktualnego użytkownika.
Risk Assessment
Jeśli aktualny użytkownik ma uprawnienia administratora, atakujący może przejąć kontrolę nad systemem, instalować programy, zmieniać lub usuwać dane oraz tworzyć nowe konta z pełnymi prawami użytkownika.
Recommendation
Zaleca się aktualizację Microsoft Edge do najnowszej wersji oraz monitorowanie i ograniczanie dostępu do podejrzanych stron internetowych, które mogą wykorzystywać tę podatność.
Related vulnerabilities
- CVE-2026-86102Critical
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
- CVE-2026-101894Critical
The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.
- CVE-2026-101891Critical
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
- CVE-2026-101081Critical
A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.
- CVE-2026-88804Critical
In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.
- CVE-2026-12342Critical
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
- CVE-2026-101077Critical
A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-101076Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101075Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101074Critical
A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attack
Vulnerability data from NVD (NIST) · CISA KEV · EPSS