CVE-2020-1012

<p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>There are multiple ways an attacker could exploit the vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit this vulnerability, and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by ensuring the Wininit.dll properly handles objects in memory.</p>

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1012Patch, Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1012Patch, Vendor Advisory

Published

Sep 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10114cPanel before 84.0.20 allows stored self-XSS via the HTML fi…6.1
• CVE-2020-10115cPanel before 84.0.20, when PowerDNS is used, allows arbitra…7.2
• CVE-2020-10116cPanel before 84.0.20 allows attackers to bypass intended re…5.3
• CVE-2020-10117cPanel before 84.0.20 mishandles enforcement of demo checks …9.1
• CVE-2020-10118cPanel before 84.0.20 allows a demo account to modify files …9.1
• CVE-2020-10119cPanel before 84.0.20 allows a demo account to achieve remot…9.8
• CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote cod…7.2
• CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code …9.8
• CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to de…6.5
• CVE-2020-10123The currency dispenser of NCR SelfSev ATMs running APTRA XFS…5.3
• CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,…7.1
• CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 im…7.6