CVE-2020-0638
Microsoft Update Notification Manager Privilege Escalation Vulnerability
CVSS
7.8
Alta
EPSS
2.5%
p85
KEV
SIM
23 de mai. de 2022
Exploit Today
76
0-100
Publicado: 14 de jan. de 2020 · Última mod.: 12 de ago. de 2026 · CWE-59
2.4%EPSS · 30 dias2.5%
2026-10-082026-11-05
Produto
Microsoft / Update Notification Manager
Vulnerabilidade
Microsoft Update Notification Manager Privilege Escalation Vulnerability
Adicionado ao KEV
23 de mai. de 2022
Corrigir até
13 de jun. de 2022
Uso conhecido em ransomware
Sim
Descrição resumida
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Ação necessária
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2020-0638
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
- portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638
- portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1121106.3 MÉD—
——0A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log
directory.
This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).4hCVE-2026-1217475.5 MÉD7.7%
——2Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it.1dCVE-2026-1217465.5 MÉD6.3%
——2Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.1dCVE-2026-1222354.7 MÉD6.4%
——2Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to make the write or edit tools follow symlinks, creating files like ~/.ssh/authorized_keys on the host.1dCVE-2026-1221364.4 MÉD1.8%
——1Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.1dCVE-2026-64672—7.0%
——2Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.2d