CVE-2020-11613

Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. By default, the Authenticated Users group has Modify permissions to the installation folder. Because of this, any user on the system can replace binaries or plant malicious DLLs to obtain elevated, or different, privileges, depending on the context of the user that runs the application.

• CWE-427
• CWE-732

• https://github.com/Crytilis/mids-reborn-hero-designer/releasesRelease Notes, Third Party Advisory
• https://www.doyler.net/security-not-included/mids-reborn-vulnerabilitiesExploit, Third Party Advisory
• https://github.com/Crytilis/mids-reborn-hero-designer/releasesRelease Notes, Third Party Advisory
• https://www.doyler.net/security-not-included/mids-reborn-vulnerabilitiesExploit, Third Party Advisory

Published

Jun 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11608An issue was discovered in the Linux kernel before 5.6.1. dr…4.3
• CVE-2020-11609An issue was discovered in the stv06xx subsystem in the Linu…4.3
• CVE-2020-1161A denial of service vulnerability exists when ASP.NET Core i…7.5
• CVE-2020-11610An issue was discovered in xdLocalStorage through 2.0.5. The…8.8
• CVE-2020-11611An issue was discovered in xdLocalStorage through 2.0.5. The…6.1
• CVE-2020-11612The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbo…7.5
• CVE-2020-11614Mids' Reborn Hero Designer 2.6.0.7 downloads the update mani…8.1
• CVE-2020-11615NVIDIA DGX servers, all BMC firmware versions prior to 3.38.…7.5
• CVE-2020-11616NVIDIA DGX servers, all BMC firmware versions prior to 3.38.…7.5
• CVE-2020-11617The RSS application on THOMSON THT741FTA 2.2.1 and Philips D…5.9
• CVE-2020-11618THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1…7.8
• CVE-2020-11619FasterXML jackson-databind 2.x before 2.9.10.4 mishandles th…8.1