CVE-2020-11081

osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.

• CWE-114
• CWE-426

• https://github.com/osquery/osquery/commit/4d4957f12a6aa0becc9d01d9f97061e1e3d809c5Patch, Third Party Advisory
• https://github.com/osquery/osquery/issues/6426Exploit, Issue Tracking, Third Party Advisory
• https://github.com/osquery/osquery/pull/6433Patch, Third Party Advisory
• https://github.com/osquery/osquery/releases/tag/4.4.0Release Notes, Third Party Advisory
• https://github.com/osquery/osquery/security/advisories/GHSA-2xwp-8fv7-c5pmThird Party Advisory
• https://github.com/osquery/osquery/commit/4d4957f12a6aa0becc9d01d9f97061e1e3d809c5Patch, Third Party Advisory
• https://github.com/osquery/osquery/issues/6426Exploit, Issue Tracking, Third Party Advisory
• https://github.com/osquery/osquery/pull/6433Patch, Third Party Advisory
• https://github.com/osquery/osquery/releases/tag/4.4.0Release Notes, Third Party Advisory
• https://github.com/osquery/osquery/security/advisories/GHSA-2xwp-8fv7-c5pmThird Party Advisory

Published

Jul 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11076In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could…7.5
• CVE-2020-11077In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could sm…7.5
• CVE-2020-11078In httplib2 before version 0.18.0, an attacker controlling u…6.8
• CVE-2020-11079node-dns-sync (npm module dns-sync) through 0.2.0 allows exe…9.8
• CVE-2020-1108A denial of service vulnerability exists when .NET Core or .…7.5
• CVE-2020-11080In nghttp2 before version 1.41.0, the overly large HTTP/2 SE…7.5
• CVE-2020-11082In Kaminari before 1.2.1, there is a vulnerability that woul…6.1
• CVE-2020-11083In October from version 1.0.319 and before version 1.0.466, …4.8
• CVE-2020-11084In iPear, the manual execution of the eval() function can le…5.4
• CVE-2020-11085In FreeRDP before 2.1.0, there is an out-of-bounds read in c…3.5
• CVE-2020-11086In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4
• CVE-2020-11087In FreeRDP less than or equal to 2.0.0, there is an out-of-b…5.4